Suricata

I think this was about providing ways to decapsulate tunnels at the capture stage, esp before RSS hashing. So this would mean capture specific support, like a special eBdf program in af-packet.