I have seen references where defrag is set to yes or set to no. For Suricata version 5.0.3, should af-packet defrag setting be set to yes or to no?
This highly depends on your setup, the default recommendation is mostly to set it to yes but it’s not uncommon to disable it.