af-packet: threads: auto, default to workers

Add a new default value for the 'threads:' setting in af-packet: "auto".
This will create as many capture threads as there are cores.

Default runmode of af-packet to workers.

src/runmode-af-packet.c

@@ -57,11 +57,11 @@
 
 extern int max_pending_packets;
 
-static const char *default_mode_autofp = NULL;
+static const char *default_mode_workers = NULL;
 
 const char *RunModeAFPGetDefaultMode(void)
 {
-    return default_mode_autofp;
+    return default_mode_workers;
 }
 
 void RunModeIdsAFPRegister(void)
@@ -73,7 +73,7 @@ void RunModeIdsAFPRegister(void)
                               "Workers af-packet mode, each thread does all"
                               " tasks from acquisition to logging",
                               RunModeIdsAFPWorkers);
-    default_mode_autofp = "autofp";
+    default_mode_workers = "workers";
     RunModeRegisterNewRunMode(RUNMODE_AFP_DEV, "autofp",
                               "Multi socket AF_PACKET mode.  Packets from "
                               "each flow are assigned to a single detect "
@@ -173,13 +173,22 @@ void *ParseAFPConfig(const char *iface)
     }
 
     if (ConfGetChildValueWithDefault(if_root, if_default, "threads", &threadsstr) != 1) {
-        aconf->threads = 1;
+        aconf->threads = 0;
     } else {
         if (threadsstr != NULL) {
+            if (strcmp(threadsstr, "auto") == 0) {
+                aconf->threads = 0;
+            } else {
                 aconf->threads = (uint8_t)atoi(threadsstr);
             }
         }
+    }
     if (aconf->threads == 0) {
+        aconf->threads = (int)UtilCpuGetNumProcessorsOnline();
+        if (aconf->threads)
+            SCLogInfo("Using %d AF_PACKET threads for interface %s", aconf->threads, iface);
+    }
+    if (aconf->threads <= 0) {
         aconf->threads = 1;
     }
 

suricata.yaml.in

@@ -367,9 +367,8 @@ nflog:
 # Set threads to > 1 to use PACKET_FANOUT support
 af-packet:
   - interface: eth0
-    # Number of receive threads (>1 will enable experimental flow pinned
-    # runmode)
-    threads: 1
+    # Number of receive threads. "auto" uses the number of cores
+    threads: auto
     # Default clusterid.  AF_PACKET will load balance packets based on flow.
     # All threads/processes that will participate need to have the same
     # clusterid.
@@ -420,7 +419,7 @@ af-packet:
     #copy-mode: ips
     #copy-iface: eth1
   - interface: eth1
-    threads: 1
+    threads: auto
     cluster-id: 98
     cluster-type: cluster_flow
     defrag: yes
@@ -428,7 +427,7 @@ af-packet:
     # disable-promisc: no
   # Put default values here
   - interface: default
-    #threads: 2
+    #threads: auto
     #use-mmap: yes
 
 legacy: