Suricata

Here is my suricata-ebpf.yaml config:

af-packet:
  - interface: enp4s0f0
    # Number of receive threads. "auto" uses the number of cores
    #threads: auto
    threads: 1
    # Default clusterid. AF_PACKET will load balance packets based on flow.
    cluster-id: 99    cluster-type: cluster_flow
    # In some fragmentation cases, the hash can not be computed. If "defrag" is set
    # to yes, the kernel will do the needed defragmentation before sending the packets.
    defrag: yes    
    copy-mode: tap
    copy-iface: enp4s0f1
    xdp-mode: driver
    pinned-maps: true
    pinned-maps-name: flow_table_v4
    xdp-filter-file:  /usr/libexec/suricata/ebpf/xdp_filter.bpf
    #bypass: yes
    use-mmap: yes
    ring-size: 200000

    #  For eBPF and XDP setup including bypass, filter and load balancing, please
    #  see doc/userguide/capture-hardware/ebpf-xdp.rst for more info.

  # Put default values here. These will be used for an interface that is not
  # in the list above.
  - interface: enp4s0f1
    threads: 1
    cluster-id: 100
    cluster-type: cluster_flow
    defrag: yes
    copy-mode: ips
    copy-iface: enp4s0f0
    xdp-mode: driver
    pinned-maps: true    pinned-maps-name: flow_table_v4
    xdp-filter-file:  /usr/libexec/suricata/ebpf/xdp_filter.bpf
    #bypass: yes
    use-mmap: yes
    ring-size: 200000

there is an already report here https://redmine.openinfosecfoundation.org/issues/6088, https://github.com/OISF/suricata/pull/9334 should be able to address this issue