Running suricata in single threaded mode with windivert module

How can we run Suricata in single threaded mode with windivert?

Using the below command:
suricata.exe -c suricata.yaml --windivert “true”
I got this as output.

How do I make packet processing threads and management threads initialized to 1.

The runmode type for windivert is : autofp only, below is the attachment:

Is it possible to make suricata run on single thread with windivert?

I didn’t try it on windivert but you can control the cpu affinity in the config file, see 10.1. Suricata.yaml — Suricata 6.0.10 documentation

I made the changes in the yaml file as you said,

But I could not change the packet processing threads.

Here is the output to list the runmode:

Here, by default windivert is working on multi-thread.

Is there any way to change it or should I compile the source code and make the changes?

Please paste your config file first so we can check the settings.

Sure, this is the config file:
suricata.yaml (72.7 KB)
Let me know if any other changes are required.

First of all I just noticed you are using 6.0.0 beta1, please use the stable 6.0.10 release.

Second, you can chance the prio section in the affinity to also use just the core 0 and in addition to that feel free to try out the detect-thread-ratio setting and reduce it to 0.5 or even lower.

I personally never tried it on windows, so see those second points just as possible suggestion. Also what CPU is used in that scenario?

Hi @Andreas_Herz
I used 6.0.0 beta1 because in that installer, windivert was enabled. I tried with the 6.0.10, but windivert was disabled.
I tried with with the points which you shared, by reducing thread-ratio, but the thread count was not set to 1.
I am using it on the machine with 8 CPU and 8 cores.
If there is any other solution, please share it.
Thank you.


E.g. 6.0.10:

Hi @vjulien
Thank you for sharing the link.
I installed this and tried to run suricata with windivert and made the changes in the configuration file to make it single threaded, but still it runs in multi-threaded mode itself.

Looks like no “single” mode is implemented for our windivert integration.

1 Like

@vjulien Thank you for the help :slightly_smiling_face: