[Oisf-users] Runmode workers (was: autofp vs auto)

elof2 at sentor.se elof2 at sentor.se
Thu Mar 10 15:25:11 UTC 2016


Hi!

On Mon, 30 Nov 2015, Victor Julien wrote:
> In short: don't use auto.
>
> In general we recommend workers instead of autofp, so I suggest going
> for that.

...and today, Oliver Humpage wrote:

>> recommended runmode?
> Default of autofp works fine here. worker specifically won’t work IIRC.



Two contradicting recommendations...

Suricata.yaml use autofp per default if you don't manually specify 
workers.

So what gives?
Should I use autofp or workers on FreeBSD sensors with netmap and intel 
10GE NICs?


I assume the answer is "workers".

Then my immediate question is:
Why don't the default suricata.yaml use "workers" if it is recommended?

/Elof


More information about the Oisf-users mailing list