In order to reduce the number of packets hitting the bad bucket. With LHTABLE of size 32 port 16257 will hit bad bucket. With other sizes port 16257 may not hit the naughty bucket.
I think the question was what number you used for the new LHTABLE, rather than the purpose of increasing it. That is, did you double it from 32 to 64? Choose a prime? Something else?
Correct, that was my question. The post doesn't say what they chose for the LHTABLE size when they recompiled the kernel, only that it was increased from 32. BTW, according to the patch the article linked to, the size has to be a power of 2. http://patchwork.ozlabs.org/patch/79014/
That makes sense - since port numbers are unsigned integers, you can just use a bitwise AND rather than a more costly MOD. I haven't actually looked at the internals of the hash, so I'm just assuming it's simply BUCKET = DPORT & MASK.
