-
Notifications
You must be signed in to change notification settings - Fork 50
Description
ndag inputs are already effectively hashed as a result of the packets arriving over multiple multicast streams, so any calls to trace_set_hasher() on an ndag libtrace_t should be ignored and print a warning message that the hasher will have no effect.
Currently, calling trace_set_hasher() on ndag inputs can cause lock ups (e.g. if an ordered combiner is involved) and/or segfaults. I assume this is because the libtrace hasher is not well suited to input sources where the packets are already distributed somehow.
Longer term, it may be worth writing a tool that can "re-hash" an ndag-like input so that users who REALLY want to enforce a different hashing method on any already distributed input can do so, e.g. telescope ndag is distributed as round-robin, but a user might require bidirectional flow based hashing for their analysis to work.