> To be honest, I'd prefer a scheme with a (large) hashtable on src/dst
> IP address; each hashtable bucket would be a doubly-linked list, with
> the src/dst IP address, the ip_id, a refcount so that pcbs can store a
> pointer to the right list entry, plus a TTL, so we can recover
> long-idle entries (finding the right pcbs is another matter).

Surely it is enough to have one count per hash?
Store the hash function result in the pcb prior to dividing by the
table size.

If the hash table is too small, double its size and replicate the
contents (so that (hash & (table_size - 1)) still points to the
same value).

You can (probably) convince yourself that you can increment the
count with locking on an MP system.

	David

-- 
David Laight: david@l8s.co.uk