if (ConfGetChildValueWithDefault(if_root, if_default, "threads", &threadsstr) != 1) {
pfconf->threads = 1;
- } else {
- if (threadsstr != NULL) {
+ } else if (threadsstr != NULL) {
+ if (strcmp(threadsstr, "auto") == 0) {
+ pfconf->threads = (int)UtilCpuGetNumProcessorsOnline();
+ if (pfconf->threads > 0) {
+ SCLogPerf("%u cores, so using %u threads", pfconf->threads, pfconf->threads);
+ } else {
+ pfconf->threads = GetIfaceRSSQueuesNum(iface);
+ if (pfconf->threads > 0) {
+ SCLogPerf("%d RSS queues, so using %u threads", pfconf->threads, pfconf->threads);
+ }
+ }
+ } else {
pfconf->threads = atoi(threadsstr);
}
}
- if (pfconf->threads == 0) {
+ if (pfconf->threads <= 0) {
pfconf->threads = 1;
}
# for more info see http://www.ntop.org/products/pf_ring/
pfring:
- interface: eth0
- # Number of receive threads.
- threads: 1
+ # Number of receive threads. If set to 'auto' Suricata will first try
+ # to use CPU (core) count and otherwise RSS queue count.
+ threads: auto
# Default clusterid. PF_RING will load balance packets based on flow.
# All threads/processes that will participate need to have the same
# Default PF_RING cluster type. PF_RING can load balance per flow.
# Possible values are cluster_flow or cluster_round_robin.
cluster-type: cluster_flow
+
# bpf filter for this interface
#bpf-filter: tcp