# Af-packet yaml reference

**URL:** https://forum.suricata.io/t/af-packet-yaml-reference/5931
**Category:** Help
**Created:** [August 16, 2025, 11:27pm UTC](https://forum.suricata.io/t/af-packet-yaml-reference/5931 "2025-08-16T23:27:38Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![KylePeterDavies](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/kylepeterdavies/32/3681_2.png) [@KylePeterDavies](https://forum.suricata.io/u/KylePeterDavies)
#### Post date: [August 16, 2025, 11:27pm UTC](https://forum.suricata.io/t/af-packet-yaml-reference/5931/1 "2025-08-16T23:27:38Z")

</div>

Hi Suricata! I am new to Suricata, and I am trying to find the YAML Reference for `af-packet` I would have expected to find the reference here: [12.1. Suricata.yaml — Suricata 8.0.1-dev documentation](https://docs.suricata.io/en/latest/configuration/suricata-yaml.html). However, I cannot seem to find a section for `af-packet`.

---

<div class="post-metadata">

### Author: ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)
#### Post date: [August 17, 2025, 12:53pm UTC](https://forum.suricata.io/t/af-packet-yaml-reference/5931/2 "2025-08-17T12:53:27Z")

</div>

We have an example in the quick start – see [2. Quickstart guide — Suricata 8.0.1-dev documentation](https://docs.suricata.io/en/latest/quickstart.html#basic-setup)

This example is for IDS mode – since you’re new to Suricata, I’m assuming that’s the mode you’ll use. In IDS mode, Suricata receives a _copy_ of packets that traverse the network. The other common mode is IPS – inline mode - where Suricata acts as a bridge between two network interfaces.

---

<div class="post-metadata">

### Author: ![KylePeterDavies](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/kylepeterdavies/32/3681_2.png) [@KylePeterDavies](https://forum.suricata.io/u/KylePeterDavies)
#### Post date: [August 17, 2025, 4:52pm UTC](https://forum.suricata.io/t/af-packet-yaml-reference/5931/3 "2025-08-17T16:52:36Z")

</div>

Hi @Jeff_Lucovsky , thanks for linking the sample in the quick start, where could I find all options for `af-packet` or is it just those mentioned in the quick start?

---

<div class="post-metadata">

### Author: ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)
#### Post date: [August 18, 2025, 12:16pm UTC](https://forum.suricata.io/t/af-packet-yaml-reference/5931/4 "2025-08-18T12:16:23Z")

</div>

The af-packet options are in the `suricata.yaml` file – most will be commented out with a brief description, and the default value will be listed.
