Design ofanti-collision network flow monitor based on hash table
Yu Li · Automation and Instrumentation · 2014
Hash table was used for processing pocket in order to monitoring network flow effectively, and discovering application and attack without delay in high rate network flow monitor based on flow. Constant lookup time of O(1) was the advantage of hash table, hash function was used to mapping flow key to hash value. This study presented two methods, addition of flow key and CRC32 method based on hash table, it is showed that attacker can create hash collision attacking using hash function through the setting of network attacking experiment, so that account of pockets were dropped. Thus, an optimal hash function was presented with disadvantage of before-mentioned methods, the research indicated that the improved hash function offering preferable performance efficiency and fast monitoring speed, and detecting network flow effectively.