Added by Eric Leblond about 13 years ago. Updated over 12 years ago.
Description
As seen during the work on unix socket, the start and stop code of suricata has become messy and needs to be improved. In particular, suricata.c needs to be clean up.
I think one of the first things we should do is determine the runmode and determine how many threads of each type we are going to be using. For example, in oisf-devel we're talking about per-worker flow engines. This implies that at initialization of the flow engine(s), we need to know the runmode and number of threads. Unless we move the flow engine init to the threads init. Anyhow, something to consider.
I've started to look into it. Regarding two separate aspects: unix socket running mode and the flow issue you mentioned, I think we should migrate a lot of init and cleaning code to the running mode code. This will allow to simplify the unix socket related code and have full flexibility regarding the Flow manager.
If no objection, I continue to look into this.
The PR https://github.com/inliniac/suricata/pull/415 is implementing some factorization...
Would that address somehow Bug #787 ?
I don't think, packet acquisition is not changed.
Closing it for now. Work has been merged.