AF PACKET

Setup

Starting in securityonion-setup - 20120912-0ubuntu0securityonion285, running Setup will configure Suricata and Bro to use AF_PACKET. (Installations already configured for PF_RING will continue to use PF_RING.)

Tuning

If you want to change the number of AF_PACKET instances after running Setup, you can do the following.

Suricata

• Stop sensor processes:
  sudo so-suricata-stop
• Edit /etc/nsm/$HOSTNAME-$INTERFACE/sensor.conf and change the IDS_LB_PROCS variable to desired number of cores.
• Start sensor processes:
  sudo so-suricata-start

so-suricata-start automatically copies $IDS_LB_PROCS into suricata.yaml and then Suricata creates the appropriate number of AF_PACKET workers.

Bro

For Bro, you would do the following:

• Stop bro:
  sudo so-bro-stop
• Edit /opt/bro/etc/node.cfg and change the lb_procs variable to the desired number of cores.
  
• Start bro:
  sudo so-bro-start