From: Jason Ish <jason.ish@oisf.net>
Date: Thu, 13 Mar 2025 18:14:26 +0000 (-0600)
Subject: af-packet: warn that tpacket-v3 is better for non-inline usage
X-Git-Tag: suricata-7.0.9~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cbd5bfbbc14d8bf123d16680520e06849dd37cad;p=thirdparty%2Fsuricata.git

af-packet: warn that tpacket-v3 is better for non-inline usage

Ticket: #7458
(cherry picked from commit 8c7ac89791db16893673e7e5dc1001f802b9a641)
---

diff --git a/src/runmode-af-packet.c b/src/runmode-af-packet.c
index bee1ad5eb4..5d0d3727aa 100644
--- a/src/runmode-af-packet.c
+++ b/src/runmode-af-packet.c
@@ -799,6 +799,11 @@ finalize:
                 iface, MAX_PACKET_SIZE);
     }
 
+    /* Warn that if not-inline, tpacket-v3 is the better choice. */
+    if (aconf->copy_mode == AFP_COPY_MODE_NONE && (aconf->flags & AFP_TPACKET_V3) == 0) {
+        SCLogWarning("%s: AF_PACKET tpacket-v3 is recommended for non-inline operation", iface);
+    }
+
     return aconf;
 }