# Pfring workers mode

**URL:** <https://forum.suricata.io/t/pfring-workers-mode/1555>\
**Category:** Help\
**Tags:** centos\
**Created:** [July 27, 2021, 2:41am UTC](https://forum.suricata.io/t/pfring-workers-mode/1555 "2021-07-27T02:41:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gary](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@gary](https://forum.suricata.io/u/gary)\
**Post date:** [July 27, 2021, 2:41am UTC](https://forum.suricata.io/t/pfring-workers-mode/1555/1 "2021-07-27T02:41:26Z")

</div>

Hello,

I am running suricata4.0.5 on centos7, when I used workers mode, there is no connect between request and respond. However, if I run with autofp mode, request and respond are in the same log. What should I do to know which request corresponds to which response?

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [July 27, 2021, 3:21pm UTC](https://forum.suricata.io/t/pfring-workers-mode/1555/2 "2021-07-27T15:21:02Z")

</div>

Can you give us more details about your configuration and setup?

Also 4.0.5 is EOL, please upgrade to a supported version of Suricata (5 or 6).

---

<div class="post-metadata">

**Author:** ![gary](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@gary](https://forum.suricata.io/u/gary)\
**Post date:** [August 6, 2021, 7:11am UTC](https://forum.suricata.io/t/pfring-workers-mode/1555/3 "2021-08-06T07:11:35Z")

</div>

Hi bro,  
Now I update to suricata-6.0.2,but the output of eve.json also detached,that means in autofp runmode, one record contains http request and respond,but with workers runmode, there are two logs record request and respond respectively.  
The eve.json setup:  
types:  
- alert:  
# payload: yes # enable dumping payload in Base64  
payload-buffer-size: 10kb # max size of payload buffer to output in eve-log  
payload-printable: yes # enable dumping payload in printable (lossy) format  
# packet: yes # enable dumping of packet (without stream segments)  
# metadata: no # enable inclusion of app layer metadata with alert. Default yes  
# http-body: yes # Requires metadata; enable dumping of HTTP body in Base64  
http-body-printable: yes # Requires metadata; enable dumping of HTTP body in printable format

```
        # Enable the logging of tagged packets for rules using the
        # "tag" keyword.
        #tagged-packets: yes
```

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [August 29, 2021, 7:10pm UTC](https://forum.suricata.io/t/pfring-workers-mode/1555/4 "2021-08-29T19:10:44Z")

</div>

In general you can use the flow\_id that should be the same for that case.