[Oisf-devel] Autofp vs. Worker runmode

[Song liu]

The online documentation did not mention how to choose between autofp and workers runmode.
The doc does mention the potential bottlenecks of autofp (like pickup-queue lock and flow lock).
So what is the potential bottleneck of workers runmode? The flow lock? As far as i understand, different workers only need to share the flow info.

Could you please give a basic idea what kinds of situation is good for autofp, or what is good for workers?
What runmodes are most of suricata users being using now?

Thank you very much.

 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20130315/3965a7dc/attachment.html>