Suricata

Currently the nfq lib doesn't support zero copy. Each "recv" call will overwrite an internal buffer, so that it's not possible to just keep a reference to this buffer.

In the single/workers runmodes this is not a problem, as all packets are processed before the next recv call.

But in auto/autofp recv, verdict and all other packet handling runs async, so we may have multiple recv calls before a packet is processed and verdicted fully. Therefore, these modes need to work on copies of the data.

Work is being done by the netfilter project to address this, once that is available, we can support zero copy for all runmodes properly.