Project

General

Profile

Actions

Optimization #2460

open

Reduce timeout in unix-socket when multiple pcaps are enqueued

Added by Maurizio Abba over 6 years ago. Updated over 1 year ago.

Status:
New
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

This is a small optimization for runmode unix-socket. Whenever a pcap is sent to the socket, the timeout for polling new pcaps is reduced. If there are no more pcaps in queue, the timeout is reset to standard value.
In this way Suricata can keep up with burst of pcaps, while reducing its CPU time when it doesn't have any work to do.

Actions

Also available in: Atom PDF