When using IPS with AF_PACKET the worker threads are created per interface. So a connection/flow will be handled one interface for one side of the traffic and another interface for the opposing side. This means that by design different threads process a single flow. The code should consider this when checking the 'wrong thread' logic. AF_PACKET and NETMAP are affected.