capture: warn -i user if faster options are available

If af-packet, netmap or pfring are available, users should use those
for best performance.

diff --git a/src/suricata.c b/src/suricata.c
index 57e7afdb067a981a38e59c94f951fd110a679e36..5d8348ccfc5c7d9cc4c86b5420ab17ac1cb6ec54 100644 (file)
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -1538,6 +1538,44 @@ static TmEcode ParseCommandLine(int argc, char** argv, SCInstance *suri)
                 return TM_ECODE_FAILED;
             }
 
+            /* warn user if af-packet, netmap or pf-ring are available */
+#if defined HAVE_AF_PACKET || HAVE_PFRING || HAVE_NETMAP
+            int i = 0;
+#ifdef HAVE_AF_PACKET
+            i++;
+#endif
+#ifdef HAVE_PFRING
+            i++;
+#endif
+#ifdef HAVE_NETMAP
+            i++;
+#endif
+            SCLogWarning(SC_WARN_FASTER_CAPTURE_AVAILABLE, "faster capture "
+                "option%s %s available:"
+#ifdef HAVE_AF_PACKET
+                " AF_PACKET (--af-packet=%s)"
+#endif
+#ifdef HAVE_PFRING
+                " PF_RING (--pfring-int=%s)"
+#endif
+#ifdef HAVE_NETMAP
+                " NETMAP (--netmap=%s)"
+#endif
+                ". Use --pcap=%s to suppress this warning",
+                i == 1 ? "" : "s", i == 1 ? "is" : "are"
+
+#ifdef HAVE_AF_PACKET
+                , optarg
+#endif
+#ifdef HAVE_PFRING
+                , optarg
+#endif
+#ifdef HAVE_NETMAP
+                , optarg
+#endif
+                , optarg
+                );
+#endif
             /* some windows shells require escaping of the \ in \Device. Otherwise
              * the backslashes are stripped. We put them back here. */
             if (strlen(optarg) > 9 && strncmp(optarg, "DeviceNPF", 9) == 0) {

diff --git a/src/util-error.c b/src/util-error.c
index 5b03c5ad15f869445fedf9db3e7840211bcf9434..3bf695504a692f0ac330113cd06d62c9de65b97a 100644 (file)
--- a/src/util-error.c
+++ b/src/util-error.c
@@ -315,6 +315,7 @@ const char * SCErrorToString(SCError err)
         CASE_CODE (SC_ERR_STATS_LOG_NEGATED);
         CASE_CODE (SC_ERR_JSON_STATS_LOG_NEGATED);
         CASE_CODE (SC_ERR_DEPRECATED_CONF);
+        CASE_CODE (SC_WARN_FASTER_CAPTURE_AVAILABLE);
     }
 
     return "UNKNOWN_ERROR";

diff --git a/src/util-error.h b/src/util-error.h
index 0dcfb674d1fa95cdb00ce3123be54426a70c856e..42fd74f9638e538160d0a6f52e0778b65e7dfa91 100644 (file)
--- a/src/util-error.h
+++ b/src/util-error.h
@@ -305,6 +305,7 @@ typedef enum {
     SC_ERR_STATS_LOG_NEGATED, /** When totals and threads are both NO in yaml **/
     SC_ERR_JSON_STATS_LOG_NEGATED, /** When totals and threads are both NO in yaml **/
     SC_ERR_DEPRECATED_CONF, /**< Deprecated configuration parameter. */
+    SC_WARN_FASTER_CAPTURE_AVAILABLE,
 } SCError;
 
 const char *SCErrorToString(SCError);