# Configuring TX/RX aggregation in Suricata

**URL:** https://forum.suricata.io/t/configuring-tx-rx-aggregation-in-suricata/2002
**Category:** Help
**Created:** [December 8, 2021, 8:06am UTC](https://forum.suricata.io/t/configuring-tx-rx-aggregation-in-suricata/2002 "2021-12-08T08:06:48Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![JEG](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@JEG](https://forum.suricata.io/u/JEG)
#### Post date: [December 8, 2021, 8:06am UTC](https://forum.suricata.io/t/configuring-tx-rx-aggregation-in-suricata/2002/1 "2021-12-08T08:06:48Z")

</div>

Hello,

I would like to know if there is a way to configure Suricata to aggregate TX trafic coming from eth0 and RX trafic coming from eth1, and how to do it.

Thank you

---

<div class="post-metadata">

### Author: ![syoc](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@syoc](https://forum.suricata.io/u/syoc)
#### Post date: [December 8, 2021, 8:38am UTC](https://forum.suricata.io/t/configuring-tx-rx-aggregation-in-suricata/2002/2 "2021-12-08T08:38:40Z")

</div>

Hi.  
I would look into interface bonding on Linux. I believe pf\_ring also can aggregate RX and TX traffic.  
Note that both cost some processing time on the sensor.

---

<div class="post-metadata">

### Author: ![JEG](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@JEG](https://forum.suricata.io/u/JEG)
#### Post date: [December 8, 2021, 8:57am UTC](https://forum.suricata.io/t/configuring-tx-rx-aggregation-in-suricata/2002/3 "2021-12-08T08:57:54Z")

</div>

> [@syoc](#):
>
> interface bonding

Hello Syoc, Thank you for your answer. I am not sure wether interface bouding can rebuild a bidirectionnal trafic from TX and RX with packet reordonnancement;

I was first looking for a native aggregation functionnality of Suricata. Does Suricata have such capacity ?

---

<div class="post-metadata">

### Author: ![syoc](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@syoc](https://forum.suricata.io/u/syoc)
#### Post date: [December 8, 2021, 9:21am UTC](https://forum.suricata.io/t/configuring-tx-rx-aggregation-in-suricata/2002/4 "2021-12-08T09:21:13Z")

</div>

I have used interface bonding with RX and TX on different interfaces to reduce “packet on wrong thread” counters, but it probably has some limitations. Suricata has no native aggregation functionality as far as I’m aware.

---

<div class="post-metadata">

### Author: ![JEG](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@JEG](https://forum.suricata.io/u/JEG)
#### Post date: [December 8, 2021, 10:27am UTC](https://forum.suricata.io/t/configuring-tx-rx-aggregation-in-suricata/2002/5 "2021-12-08T10:27:31Z")

</div>

Ok thank you very much.

---

<div class="post-metadata">

### Author: ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [December 8, 2021, 10:22pm UTC](https://forum.suricata.io/t/configuring-tx-rx-aggregation-in-suricata/2002/6 "2021-12-08T22:22:11Z")

</div>

Besides bonding there might be some options coming in the future via DPDK if that would support it to merge it upfront. But if you also think that there is a timing diff it could get difficult. This might be something for a SMART NIC or even a packetbroker before you forward it.
