<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Just run suricata with --napatech and --runmode autofp.<div><br></div><div>To have some tuning of the number of detect threads you can play around with the detect-thread-ratio configuration item in the yaml file. </div><div><br><div><div apple-content-edited="true">
<div>Matt Keeler</div><div>nPulse Technologies, Inc.<i><br></i></div><div><a href="mailto:mk@npulsetech.com">mk@npulsetech.com</a></div><div><br></div><br class="Apple-interchange-newline">
</div>
<br><div><div>On Dec 14, 2012, at 7:51 AM, Stefano Debenedetti <<a href="mailto:ste@demaledetti.net">ste@demaledetti.net</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><blockquote type="cite">Date: Thu, 13 Dec 2012 12:17:41 -0500<br>From: Matthew Keeler <<a href="mailto:mk@npulsetech.com">mk@npulsetech.com</a>><br>To: Stefano Debenedetti <<a href="mailto:ste@demaledetti.net">ste@demaledetti.net</a>><br>Cc: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>Subject: Re: [Oisf-users] Napatech support in Suricata: thread<br><span class="Apple-tab-span" style="white-space:pre"> </span>configuration<span class="Apple-tab-span" style="white-space:pre"> </span>and flow pinning<br>Message-ID: <1E5C9C1A-<a href="mailto:C3FA-4138-A1FE-6B308F3F9C0A@npulsetech.com">C3FA-4138-A1FE-6B308F3F9C0A@npulsetech.com</a>><br>Content-Type: text/plain; charset="us-ascii"<br><br>Yes, the autofp run mode is probably more in line with what you want. In that scenario it should still spawn 1 acquisition thread per stream, but the number of detect threads not be tied to it and should spawn many more threads.<br></blockquote><br><br>What would the configuration look like for achieving this?<br><br><br>Thank you ciao<br>ste<br><br>_______________________________________________<br>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a><br>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>OISF: <a href="http://www.openinfosecfoundation.org/">http://www.openinfosecfoundation.org/</a><br></blockquote></div><br></div></div></body></html>
<pre>--------------------------------------------------------------------
The information contained herein is for the exclusive use of the original recipient. This information is granted for limited distribution within the recipient's organization for planning purposes only. Further dissemination, whether private or public, is prohibited and may be covered under a non-disclosure agreement.