Suricata

Latency is simply to high for any type of sane operation. We already warn for this: "Using tpacket_v3 in IPS mode will result in high latency".

The problem for v3 is that the block based approach induces latency. Smaller block sizes reduce this latency, but if traffic is so low that blocks don't get filled quickly the timeout logic kicks in. As this has a millisecond resolution we will have a minimum latency of 1ms in that case.

In v2 my measurements are more around 60 to 90 usec, so at least an order of magnitude less.