Suricata

AF_PACKET will detect when the interface goes down and reopen the interface when it gets back up.

It does appear the interfaces are not necessarily reopening their sockets in the same order as before and it seems they are also not waiting for all threads to reopen before processing packets. I suspect this means that during the reopening the fanout is all over the place, and after the reopening flows may not going to their threads. Needs review and testing.