performance configuration

DPDK threads: 2 Worker threads: 2

environment

• DPDK: 18.11.7
• Linux: 4.15.0-99-generic
• Interface: 10G * 2 X710 (Fotville)
• Suricata Mode: IPS

Rules:

• alert udp any any <> any any
• drop udp any any <> any any

YAML specific

  set-cpu-affinity: yes
  # Tune cpu affinity of suricata threads. Each family of threads can be bound
  # on specific CPUs.
  cpu-affinity:
    - management-cpu-set:
        cpu: [ 0 ]  # include only these cpus in affinity settings
    - receive-cpu-set:
        cpu: [ 1,2 ]  # include only these cpus in affinity settings
    - decode-cpu-set:
        cpu: [ 1,2 ]
        mode: "balanced"
    - stream-cpu-set:
        cpu: [ "1-2" ]
    - detect-cpu-set:
        cpu: [ "1-2" ]
        mode: "exclusive" # run detect threads in these cpus
        # Use explicitely 3 threads and don't compute number by using
        # detect-thread-ratio variable:
        # threads: 3
        prio:
          low: [ "1-2" ]
          medium: [ "1-2" ]
          high: [ "1-2" ]
          default: "medium"
    - verdict-cpu-set:
        cpu: [ "1-2" ]
        prio:
          default: "high"
    - reject-cpu-set:
        cpu: [ "1-2" ]
        prio:
          default: "low"
    - output-cpu-set:
        cpu: [ "1-2" ]
        prio:
           default: "medium"