OOBE -6- increasing max-pending-packets default value
This is part of OOBE tickets line.
Out Of the Box Experience(OOBE) is aimed at providing better defaults values in suricata.yaml
single: 128 workers: 4096 autofp: 32768 (or maybe 2048 * thread cnt) cuda: 64k
Updated by Peter Manev about 3 years ago
The challenge here is that we also need to be cautious as to for the situations where Suricata is run on very small devices. In those cases we would also want to offer good experience right out if the box.
I have been going back and forth (internally :) ) quite a few times on this. It seems it might be better to offer some sort of quick "perf guide" where a user can just adjust a few basic settings without needing to dive into advanced tuning.
Updated by Andreas Herz about 3 years ago
Well if someone is running suricata on a small device like raspi I would expect some knowledge/time to tune it. I would expect the default to match a "normal" system. I would suggest 32k or 64k as that shouldn't really have a huge impact right?