Don, one more thing to observe for your tests: each line from ip_conntrack is hashed twice, with mirrored source / destination addresses. Ideally, for a sufficiently oversized bucket count, that would be immaterial. For the too-small-bucket case, hash list lengths should double. With a too-bad hash function, things could get even worse.
(My apologies if you already did this doubling in your test code; my meatware lisp parser is not very good...) best regards Patrick
