capture: warn -i user if faster options are available

If af-packet, netmap or pfring are available, users should use those
for best performance.

src/suricata.c

@@ -1538,6 +1538,44 @@ static TmEcode ParseCommandLine(int argc, char** argv, SCInstance *suri)
                 return TM_ECODE_FAILED;
             }
 
+            /* warn user if af-packet, netmap or pf-ring are available */
+#if defined HAVE_AF_PACKET || HAVE_PFRING || HAVE_NETMAP
+            int i = 0;
+#ifdef HAVE_AF_PACKET
+            i++;
+#endif
+#ifdef HAVE_PFRING
+            i++;
+#endif
+#ifdef HAVE_NETMAP
+            i++;
+#endif
+            SCLogWarning(SC_WARN_FASTER_CAPTURE_AVAILABLE, "faster capture "
+                "option%s %s available:"
+#ifdef HAVE_AF_PACKET
+                " AF_PACKET (--af-packet=%s)"
+#endif
+#ifdef HAVE_PFRING
+                " PF_RING (--pfring-int=%s)"
+#endif
+#ifdef HAVE_NETMAP
+                " NETMAP (--netmap=%s)"
+#endif
+                ". Use --pcap=%s to suppress this warning",
+                i == 1 ? "" : "s", i == 1 ? "is" : "are"
+
+#ifdef HAVE_AF_PACKET
+                , optarg
+#endif
+#ifdef HAVE_PFRING
+                , optarg
+#endif
+#ifdef HAVE_NETMAP
+                , optarg
+#endif
+                , optarg
+                );
+#endif
             /* some windows shells require escaping of the \ in \Device. Otherwise
              * the backslashes are stripped. We put them back here. */
             if (strlen(optarg) > 9 && strncmp(optarg, "DeviceNPF", 9) == 0) {

src/util-error.c

@@ -315,6 +315,7 @@ const char * SCErrorToString(SCError err)
         CASE_CODE (SC_ERR_STATS_LOG_NEGATED);
         CASE_CODE (SC_ERR_JSON_STATS_LOG_NEGATED);
         CASE_CODE (SC_ERR_DEPRECATED_CONF);
+        CASE_CODE (SC_WARN_FASTER_CAPTURE_AVAILABLE);
     }
 
     return "UNKNOWN_ERROR";

src/util-error.h

@@ -305,6 +305,7 @@ typedef enum {
     SC_ERR_STATS_LOG_NEGATED, /** When totals and threads are both NO in yaml **/
     SC_ERR_JSON_STATS_LOG_NEGATED, /** When totals and threads are both NO in yaml **/
     SC_ERR_DEPRECATED_CONF, /**< Deprecated configuration parameter. */
+    SC_WARN_FASTER_CAPTURE_AVAILABLE,
 } SCError;
 
 const char *SCErrorToString(SCError);