Suricata

With nfq + workers, the number of packet processing threads is equal to the number of queues you use. E.g. -q0 gives 1 thread, -q0 -q1 2, etc. If you use --runmode=autofp, it will use: 1 capture thread, 1 verdict thread and N detect threads. N depends on cores and settings.

means if in case i use nfq of "queue 0" and runmode as "worker" then so we are have 1 thread as(capture thread, verdict thread and detect threads) and using only one core(for example id=0 of 4 cores) and is it using the same core id=0 only or it can switch to another core id=1,....?

and i would like to know does suricata is completely ndpi type?

Rahul Surya wrote:

means if in case i use nfq of "queue 0" and runmode as "worker" then so we are have 1 thread as(capture thread, verdict thread and detect threads) and using only one core(for example id=0 of 4 cores) and is it using the same core id=0 only or it can switch to another core id=1,....?

This depends on your system, but if you want to have more control about that you can use --queue-cpu-fanout in combination with --queue-balance x:y to control the amount of cores and what core attached to the queue.

Rahul Surya wrote:

and i would like to know does suricata is completely ndpi type?

You should open another issue for a new request, but there are elements of dpi that suricata can cover.