Suricata

In autofp mode, the packetpool logic creates a complex dynamic between the capture thread(s) and the worker threads. Packets are taken for the capture thread's pool, and passed on to a worker thread. It's the responsibility of the worker thread to return packets to the pool they belong to.

It has been observed that at least during pcap based offline tests, stalls can happen where the capture packet pool is empty and the capture thread is waiting for packets to be returned to it.

There appear to be several reasons for this. They will be addressed in subtickets and related tickets.