[Oisf-users] Runmode workers (was: autofp vs auto)

[Tom DeCanio]

Always use workers runmode if your hardware will split your ingress traffic.

On Thu, Mar 10, 2016 at 7:25 AM, <elof2 at sentor.se> wrote:

>
> Hi!
>
> On Mon, 30 Nov 2015, Victor Julien wrote:
>
>> In short: don't use auto.
>>
>> In general we recommend workers instead of autofp, so I suggest going
>> for that.
>>
>
> ...and today, Oliver Humpage wrote:
>
> recommended runmode?
>>>
>> Default of autofp works fine here. worker specifically won’t work IIRC.
>>
>
>
>
> Two contradicting recommendations...
>
> Suricata.yaml use autofp per default if you don't manually specify workers.
>
> So what gives?
> Should I use autofp or workers on FreeBSD sensors with netmap and intel
> 10GE NICs?
>
>
> I assume the answer is "workers".
>
> Then my immediate question is:
> Why don't the default suricata.yaml use "workers" if it is recommended?
>
> /Elof
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 9-11 in Washington, DC:
> http://oisfevents.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20160310/9c80ba61/attachment.html>