doc: runmodes

diff --git a/doc/sphinx/performance/index.rst b/doc/sphinx/performance/index.rst
index bfdf391048be8865840de18b9318f96220533763..d76b8082ccb319b075b954ce03136e265a4afe69 100644 (file)
--- a/doc/sphinx/performance/index.rst
+++ b/doc/sphinx/performance/index.rst
@@ -8,3 +8,4 @@ Performance
    statistics
    packet-profiling
    rule-profiling
+   runmodes

diff --git a/doc/sphinx/performance/runmodes.rst b/doc/sphinx/performance/runmodes.rst
new file mode 100644 (file)
index 0000000..0927501
--- /dev/null
+++ b/doc/sphinx/performance/runmodes.rst
@@ -0,0 +1,35 @@
+Runmodes
+========
+
+Suricata consists of several 'building blocks' called threads,
+thread-modules and queues.  A thread is like a process that runs on a
+computer. Suricata is multi-threaded, so multiple threads are active
+at once.  A thread-module is a part of a functionality. One module is
+for example for decoding a packet, another is the detect-module and
+another one the output-module.  A packet can be processed by more than
+one thread. The packet will be passed on to the next thread through a
+queue. Packets will be processed by one thread at a time, but there
+can be multiple packets being processed at a time by the engine. (see
+[[**FIXME** suricata.yaml#max-pending-packets]]) A thread can have one or more
+thread-modules. If they have more modules, they can only be active on
+a a time.  The way threads, modules and queues are arranged together
+is called the Runmode.
+
+Different runmodes
+~~~~~~~~~~~~~~~~~~
+
+You can choose a runmode out of several predefined runmodes. The
+command line option --list-runmodes shows all available runmodes.  All
+runmodes have a name: auto, single, autofp.  The heaviest task is the
+detection; a packet will be checked against thousands of signatures.
+
+Example of the default runmode:
+
+.. image:: runmodes/threading1.png
+
+In the pfring mode, every flow follows its own fixed route in the runmode.
+
+.. image:: runmodes/Runmode_autofp.png
+
+For more information about the command line options concerning the
+runmode, see :doc:`../command-line-options`.

diff --git a/doc/sphinx/performance/runmodes/Runmode_autofp.png b/doc/sphinx/performance/runmodes/Runmode_autofp.png
new file mode 100644 (file)
index 0000000..42db21d
Binary files /dev/null and b/doc/sphinx/performance/runmodes/Runmode_autofp.png differ

diff --git a/doc/sphinx/performance/runmodes/threading1.png b/doc/sphinx/performance/runmodes/threading1.png
new file mode 100644 (file)
index 0000000..399bf67
Binary files /dev/null and b/doc/sphinx/performance/runmodes/threading1.png differ