<div dir="ltr">Dear Peter, <br>my  af-packet  section in suricata.yaml looks like this:<br>af-packet:<br>  - interface: p115p4<br>     threads: 8<br>     cluster-id: 99<br>     cluster-type: cluster_cpu<br>     defrag: yes<br>

    use-mmap: yes<br>    ring-size: 5000<br>    buffer-size: 262144<br>    interface: p115p3<br>    threads: 8<br>    cluster-id: 98<br>    cluster-type: cluster_cpu<br>    defrag: yes<br>    use-mmap: yes<br>    ring-size: 5000<br>

    buffer-size: 262144<br>   copy-mode: ips   <br>   copy-iface: p115p4<div class="gmail_extra"><br><br></div></div>