diff --git a/util/deephash/deephash_test.go b/util/deephash/deephash_test.go
index 42cf00f54..29c0b425e 100644
--- a/util/deephash/deephash_test.go
+++ b/util/deephash/deephash_test.go
@@ -324,6 +324,57 @@ func BenchmarkHash(b *testing.B) {
 	}
 }
 
+func ptrTo[T any](v T) *T { return &v }
+
+// filterRules is a packet filter that has both everything populated (in its
+// first element) and also a few entries that are the typical shape for regular
+// packet filters as sent to clients.
+var filterRules = []tailcfg.FilterRule{
+	{
+		SrcIPs:  []string{"*", "10.1.3.4/32", "10.0.0.0/24"},
+		SrcBits: []int{1, 2, 3},
+		DstPorts: []tailcfg.NetPortRange{{
+			IP:    "1.2.3.4/32",
+			Bits:  ptrTo(32),
+			Ports: tailcfg.PortRange{First: 1, Last: 2},
+		}},
+		IPProto: []int{1, 2, 3, 4},
+		CapGrant: []tailcfg.CapGrant{{
+			Dsts: []netaddr.IPPrefix{netaddr.MustParseIPPrefix("1.2.3.4/32")},
+			Caps: []string{"foo"},
+		}},
+	},
+	{
+		SrcIPs: []string{"foooooooooo"},
+		DstPorts: []tailcfg.NetPortRange{{
+			IP:    "baaaaaarrrrr",
+			Ports: tailcfg.PortRange{First: 1, Last: 2},
+		}},
+	},
+	{
+		SrcIPs: []string{"foooooooooo"},
+		DstPorts: []tailcfg.NetPortRange{{
+			IP:    "baaaaaarrrrr",
+			Ports: tailcfg.PortRange{First: 1, Last: 2},
+		}},
+	},
+	{
+		SrcIPs: []string{"foooooooooo"},
+		DstPorts: []tailcfg.NetPortRange{{
+			IP:    "baaaaaarrrrr",
+			Ports: tailcfg.PortRange{First: 1, Last: 2},
+		}},
+	},
+}
+
+func BenchmarkHashPacketFilter(b *testing.B) {
+	b.ReportAllocs()
+
+	for i := 0; i < b.N; i++ {
+		sink = Hash(filterRules)
+	}
+}
+
 func TestHashMapAcyclic(t *testing.T) {
 	m := map[int]string{}
 	for i := 0; i < 100; i++ {