From: Jason Ish <jason.ish@oisf.net>
Date: Thu, 13 Mar 2025 18:14:26 +0000 (-0600)
Subject: af-packet: warn that tpacket-v3 is better for non-inline usage
X-Git-Tag: suricata-8.0.0-beta1~266
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8c7ac89791db16893673e7e5dc1001f802b9a641;p=thirdparty%2Fsuricata.git

af-packet: warn that tpacket-v3 is better for non-inline usage

Ticket: #7458
---

diff --git a/src/runmode-af-packet.c b/src/runmode-af-packet.c
index 6537435f65..65a7718db5 100644
--- a/src/runmode-af-packet.c
+++ b/src/runmode-af-packet.c
@@ -773,6 +773,11 @@ finalize:
                 iface, MAX_PACKET_SIZE);
     }
 
+    /* Warn that if not-inline, tpacket-v3 is the better choice. */
+    if (aconf->copy_mode == AFP_COPY_MODE_NONE && (aconf->flags & AFP_TPACKET_V3) == 0) {
+        SCLogWarning("%s: AF_PACKET tpacket-v3 is recommended for non-inline operation", iface);
+    }
+
     return aconf;
 }