Hello, I recently used suricata7.0 dpdk to capture packets, and found that one worker thread is only responsible for the queue of one network card. When multiple network cards are used, multiple worker threads will return to the same cpu. In dpdk, rotation training will cause cpu preemption. Whether to consider modifying this situation. Ensure that a worker thread only works on one cpu. A worker thread can be responsible for queue packet capture of multiple network cards to avoid preemption.
Did you consider Suricata’s thread affinity? It will avoid all the threads running on the same core.