doc/performance: redo runmodes explanation

diff --git a/doc/userguide/performance/runmodes.rst b/doc/userguide/performance/runmodes.rst
index 8f05f8de9f38b9ae1f59df4faa3e1d9e1379d52f..6de162e6545ec145ee3a38b9f2f46f427b5fec61 100644 (file)
--- a/doc/userguide/performance/runmodes.rst
+++ b/doc/userguide/performance/runmodes.rst
@@ -19,17 +19,30 @@ Different runmodes
 ~~~~~~~~~~~~~~~~~~
 
 You can choose a runmode out of several predefined runmodes. The
-command line option --list-runmodes shows all available runmodes.  All
-runmodes have a name: auto, single, autofp.  The heaviest task is the
-detection; a packet will be checked against thousands of signatures.
+command line option --list-runmodes shows all available runmodes. All
+runmodes have a name: single, workers, autofp.
 
-Example of the default runmode:
+Generally, the ``workers`` runmode performs the best. In this mode the
+NIC/driver makes sure packets are properly balanced over Suricata's
+processing threads. Each packet processing thread then contains the
+full packet pipeline.
 
-.. image:: runmodes/threading1.png
+.. image:: runmodes/workers.png
 
-In the pfring mode, every flow follows its own fixed route in the runmode.
+For processing PCAP files, or in case of certain IPS setups (like NFQ),
+``autofp`` is used. Here there are one or more capture threads, that
+capture the packet and do the packet decoding, after which it is passed
+on to the ``flow worker`` threads.
 
-.. image:: runmodes/Runmode_autofp.png
+.. image:: runmodes/autofp1.png
+
+.. image:: runmodes/autofp2.png
+
+Finally, the ``single`` runmode is the same as the ``workers`` mode,
+however there is only a single packet processing thread. This useful
+during development.
+
+.. image:: runmodes/single.png
 
 For more information about the command line options concerning the
 runmode, see :doc:`../command-line-options`.

diff --git a/doc/userguide/performance/runmodes/autofp1.png b/doc/userguide/performance/runmodes/autofp1.png
new file mode 100644 (file)
index 0000000..6bbcc94
Binary files /dev/null and b/doc/userguide/performance/runmodes/autofp1.png differ

diff --git a/doc/userguide/performance/runmodes/autofp2.png b/doc/userguide/performance/runmodes/autofp2.png
new file mode 100644 (file)
index 0000000..d9c944d
Binary files /dev/null and b/doc/userguide/performance/runmodes/autofp2.png differ

diff --git a/doc/userguide/performance/runmodes/single.png b/doc/userguide/performance/runmodes/single.png
new file mode 100644 (file)
index 0000000..1623a4b
Binary files /dev/null and b/doc/userguide/performance/runmodes/single.png differ

diff --git a/doc/userguide/performance/runmodes/workers.png b/doc/userguide/performance/runmodes/workers.png
new file mode 100644 (file)
index 0000000..eabbe27
Binary files /dev/null and b/doc/userguide/performance/runmodes/workers.png differ