hello people,

I am writing some code ( C / C++ languages...) whose work is to capture the packets and search for some strings which are there in the database provided with. I want my code work consistently even on the networks with huge bandwidth where thousands of packets will be arriving at every second. I want it to be extreme robust in nature and also don't want to give up even a time of single clock cycle.

In between I met with a need to maintain some hash structure using which I will be keeping track of all the connections using the four parameters : source port, destination port, source IP, and Destination Ip.




Can any body please tell me if I use the hash_map (or any other STL if any?) will be helpful to me?


it will consume more time and better to prepare my own?



I am not sure about which option to choose.





.

The STL is a not always pretty, but it'll save you a lot of time and bugs - if you code you own version of hash_map, you almost certainly will have some bugs which will be a pain to iron out, so why waste the time when you can use a well tested implementation of the same structures?

Perhaps you know this already (and have a reason for not using it), but there is already a C library that you can use to capture packets - pcap.

the information i provided is some thing deviating / a little bit ambiguous. I am using the pcap lib itself for capturing the packets. after capturing, for the sake of keeping track of all the connections, I want to use a hash or a hash like structure. when ever a new packet arrives, I will check to which connection it belongs to and then depending on that information, I have to do some other specific work.

the thing is if I go to hash, the positions of ports and ip addresses changes w.r.t. request and response. If I blindly use the values, I wont be able to pin point the same location.

I will get a packet. I don't know whether it has come from client or from server and also it is not much required.