From: Jason Ish <jason.ish@oisf.net>
Date: Wed, 12 Mar 2025 21:56:40 +0000 (-0600)
Subject: af-packet: increase default block size
X-Git-Tag: suricata-7.0.9~12
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b2d2b70745566a8accf7bb33c3d5970b9999c9d1;p=thirdparty%2Fsuricata.git

af-packet: increase default block size

Increase the default block size from 32k to 128k. This allows for a
fully defragmented packet to fit in the buffer.

Ticket: #7458
(cherry picked from commit c342b054f40630521253666d3ca0192250a59ad2)
---

diff --git a/src/source-af-packet.h b/src/source-af-packet.h
index d91d0cb252..7d04704a9d 100644
--- a/src/source-af-packet.h
+++ b/src/source-af-packet.h
@@ -75,7 +75,7 @@ struct ebpf_timeout_config {
  * page_size << order. So default value is using the same formula with
  * an order of 3 which guarantee we have some room in the block compared
  * to standard frame size */
-#define AFP_BLOCK_SIZE_DEFAULT_ORDER 3
+#define AFP_BLOCK_SIZE_DEFAULT_ORDER 5
 
 typedef struct AFPIfaceConfig_
 {