How can we run Suricata in single threaded mode with windivert?
Using the below command:
suricata.exe -c suricata.yaml --windivert “true”
I got this as output.
How do I make packet processing threads and management threads initialized to 1.
The runmode type for windivert is : autofp only, below is the attachment:
Is it possible to make suricata run on single thread with windivert?
I didn’t try it on windivert but you can control the cpu affinity in the config file, see 10.1. Suricata.yaml — Suricata 6.0.10 documentation
@Andreas_Herz
I made the changes in the yaml file as you said,
Here is the output to list the runmode:
Is there any way to change it or should I compile the source code and make the changes?
Please paste your config file first so we can check the settings.
@Andreas_Herz
Sure, this is the config file:
suricata.yaml (72.7 KB)
Let me know if any other changes are required.
Thanks
First of all I just noticed you are using 6.0.0 beta1, please use the stable 6.0.10 release.
Second, you can chance the prio section in the affinity to also use just the core 0 and in addition to that feel free to try out the detect-thread-ratio setting and reduce it to 0.5 or even lower.
I personally never tried it on windows, so see those second points just as possible suggestion. Also what CPU is used in that scenario?
Hi @Andreas_Herz
I used 6.0.0 beta1 because in that installer, windivert was enabled. I tried with the 6.0.10, but windivert was disabled.
I tried with with the points which you shared, by reducing thread-ratio, but the thread count was not set to 1.
I am using it on the machine with 8 CPU and 8 cores.
If there is any other solution, please share it.
Thank you.
Check:
https://www.openinfosecfoundation.org/downloads/windows/
E.g. 6.0.10:
https://www.openinfosecfoundation.org/downloads/windows/Suricata-6.0.10-windivert-1-64bit.msi
Hi @vjulien
Thank you for sharing the link.
I installed this and tried to run suricata with windivert and made the changes in the configuration file to make it single threaded, but still it runs in multi-threaded mode itself.
Looks like no “single” mode is implemented for our windivert integration.
