Suricata

This diff puts last_dump outside of the PcapCallbackLoop() function. It'll survive for comparison for the next time through the function.

The net effect is a drop of up to a million ioctls a minute (whatever your packet rate is) to just a few hundred (60 stat scans and the normal ones).

--- ../../suricata-master.orig/src/source-pcap.c        Sun Dec  1 21:37:52 2013
+++ source-pcap.c       Wed Dec 18 00:01:05 2013
@@ -224,12 +224,13 @@

 #endif

+time_t last_dump = 0;
+
 void PcapCallbackLoop(char *user, struct pcap_pkthdr *h, u_char *pkt) {
     SCEnter();

     PcapThreadVars *ptv = (PcapThreadVars *)user;
     Packet *p = PacketGetFromQueueOrAlloc();
-    time_t last_dump = 0;
     struct timeval current_time;

     if (unlikely(p == NULL)) {