pfring: implement 'threads: auto'

If threads is set to auto, first try the CPU count. If that would
fail, fall back to RSS queue count.

src/runmode-pfring.c

@@ -247,12 +247,22 @@ static void *ParsePfringConfig(const char *iface)
 
     if (ConfGetChildValueWithDefault(if_root, if_default, "threads", &threadsstr) != 1) {
         pfconf->threads = 1;
+    } else if (threadsstr != NULL) {
+        if (strcmp(threadsstr, "auto") == 0) {
+            pfconf->threads = (int)UtilCpuGetNumProcessorsOnline();
+            if (pfconf->threads > 0) {
+                SCLogPerf("%u cores, so using %u threads", pfconf->threads, pfconf->threads);
+            } else {
+                pfconf->threads = GetIfaceRSSQueuesNum(iface);
+                if (pfconf->threads > 0) {
+                    SCLogPerf("%d RSS queues, so using %u threads", pfconf->threads, pfconf->threads);
+                }
+            }
         } else {
-        if (threadsstr != NULL) {
             pfconf->threads = atoi(threadsstr);
         }
     }
-    if (pfconf->threads == 0) {
+    if (pfconf->threads <= 0) {
         pfconf->threads = 1;
     }
 

suricata.yaml.in

@@ -1725,8 +1725,9 @@ netmap:
 # for more info see http://www.ntop.org/products/pf_ring/
 pfring:
   - interface: eth0
-    # Number of receive threads.
-    threads: 1
+    # Number of receive threads. If set to 'auto' Suricata will first try
+    # to use CPU (core) count and otherwise RSS queue count.
+    threads: auto
 
     # Default clusterid.  PF_RING will load balance packets based on flow.
     # All threads/processes that will participate need to have the same
@@ -1736,6 +1737,7 @@ pfring:
     # Default PF_RING cluster type. PF_RING can load balance per flow.
     # Possible values are cluster_flow or cluster_round_robin.
     cluster-type: cluster_flow
+
     # bpf filter for this interface
     #bpf-filter: tcp