From: Jeff Lucovsky Date: Mon, 17 Apr 2023 13:17:56 +0000 (-0400) Subject: add to doc/pfring: Document additional cluster types X-Git-Tag: suricata-6.0.12~18 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0730fdcd6b5643da9470e03c014c83e1615e944e;p=thirdparty%2Fsuricata.git add to doc/pfring: Document additional cluster types (cherry picked from commit 0ad6d4358f11d6d856f017726651182282b95281) --- diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst index df466cb610..40430b52b8 100644 --- a/doc/userguide/configuration/suricata-yaml.rst +++ b/doc/userguide/configuration/suricata-yaml.rst @@ -1919,6 +1919,9 @@ type value; in a round robin manner or a per flow manner that are part of the same cluster. All traffic for pf_ring will be load balanced across acquisition threads of the same cluster id. +The "inner" flow means that the traffic will be load balanced based on +address tuple after the outer vlan has been removed. + +----------------------------+--------------------------------------------------+ | Cluster Type | Value | +============================+==================================================+ @@ -1943,9 +1946,9 @@ of the same flow to the same thread. The flows itself will be distributed to the threads in a round-robin manner. If your deployment has VLANs, the cluster types with "inner" will use the innermost -tuple for distribution. +address tuple for distribution. -Round-robin is not recommended with Suricata. +The default cluster type is ``cluster_flow``; the ``cluster_round_robin`` is not recommended with Suricata. ::