Project

General

Profile

Actions
Copy link

Optimization #2460

open

Reduce timeout in unix-socket when multiple pcaps are enqueued

Added by Maurizio Abba about 6 years ago. Updated 12 months ago.

Status:
New
Priority:
Normal
Assignee:
Community Ticket
Target version:
TBD
Effort:
Difficulty:
Label:

Description

This is a small optimization for runmode unix-socket. Whenever a pcap is sent to the socket, the timeout for polling new pcaps is reduced. If there are no more pcaps in queue, the timeout is reset to standard value.
In this way Suricata can keep up with burst of pcaps, while reducing its CPU time when it doesn't have any work to do.

Actions
Copy link

Also available in: Atom PDF