af-packet: change configuration format for multi interface

suricata.yaml

@@ -157,27 +157,32 @@ nfq:
 # af-packet support
 # Set threads to > 1 to use PACKET_FANOUT support
 af-packet:
-  # Number of receive threads (>1 will enable experimental flow pinned
+  - interface: eth0
-  # runmode)
+    # Number of receive threads (>1 will enable experimental flow pinned
-  threads: 1
+    # runmode)
-  # default network interface
+    threads: 1
-  interface: eth0
+    # Default clusterid.  AF_PACKET will load balance packets based on flow.
-  # Default clusterid.  AF_PACKET will load balance packets based on flow.
+    # All threads/processes that will participate need to have the same
-  # All threads/processes that will participate need to have the same
+    # clusterid.
-  # clusterid.
+    cluster-id: 99
-  cluster-id: 99
+    # Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.
-  # Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.
+    # This is only supported for Linux kernel > 3.1
-  # This is only supported for Linux kernel > 3.1
+    # possible value are:
-  # possible value are:
+    #  * cluster_round_robin: round robin load balancing
-  #  * cluster_round_robin: round robin load balancing
+    #  * cluster_flow: all packets of a given flow are send to the same socket
-  #  * cluster_flow: all packets of a given flow are send to the same socket
+    #  * cluster_cpu: all packets treated in kernel by a CPU are send to the same socket
-  #  * cluster_cpu: all packets treated in kernel by a CPU are send to the same socket
+    cluster-type: cluster_round_robin
-  cluster-type: cluster_round_robin
+    # In some fragmentation case, the hash can not be computed. If "defrag" is set
-  # In some fragmentation case, the hash can not be computed. If "defrag" is set
+    # to yes, the kernel will do the needed defragmentation before sending the packets.
-  # to yes, the kernel will do the needed defragmentation before sending the packets.
+    defrag: yes
-  defrag: yes
+    # recv buffer size, increase value could improve performance
-  # recv buffer size, increase value could improve performance
+    # buffer-size: 32768
-  # buffer-size: 32768
+  - interface: eth1
+    threads: 1
+    cluster-id: 98
+    cluster-type: cluster_round_robin
+    defrag: yes
+    # buffer-size: 32768
 
 defrag:
   max-frags: 65535