Suricata

Add telemetry for the detect.thresholds hash table that gives the user an indication of bucket density and max.

average -- display the mean number of entries across non-empty buckets. A value close to 1 means the entries are well-distributed with minimum collisions
max - shows the deepest current bucket depth. This catches host-spot problems that are lost in the average. If the average is low but the max is high, then there's a badly skewed hash as one bucket is doing 50 comparisons per lookup while most do 1-2.

When both are low, the hash function and table size are well-matched to the workload.

If both are high, the table is too small and the hash_size should be increased.