# Still seeing a lot of pkt\_on\_wrong\_thread

**URL:** <https://forum.suricata.io/t/still-seeing-a-lot-of-pkt-on-wrong-thread/2819>\
**Category:** Help\
**Created:** [October 3, 2022, 11:55am UTC](https://forum.suricata.io/t/still-seeing-a-lot-of-pkt-on-wrong-thread/2819 "2022-10-03T11:55:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![noob\_17](https://avatars.discourse-cdn.com/v4/letter/n/839c29/32.png) [@noob\_17](https://forum.suricata.io/u/noob_17)\
**Post date:** [October 3, 2022, 11:55am UTC](https://forum.suricata.io/t/still-seeing-a-lot-of-pkt-on-wrong-thread/2819/1 "2022-10-03T11:55:12Z")

</div>

Hi,

I keep seeing an increase of `tcp.pkt_on_wrong_thread` when using workers mode. Switching to autofp mode the issue disappears.

Is there any possible solution to this?

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [October 8, 2022, 9:07pm UTC](https://forum.suricata.io/t/still-seeing-a-lot-of-pkt-on-wrong-thread/2819/2 "2022-10-08T21:07:10Z")

</div>

that is currently still work in progress, see [Optimization #2725: stream/packet on wrong thread - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/issues/2725)  
but there are a lot things that depend on it.

So you can try `cluster_qm` mode with RSS enabled and play around with the flow distribution support of your NIC.

---

<div class="post-metadata">

**Author:** ![noob\_17](https://avatars.discourse-cdn.com/v4/letter/n/839c29/32.png) [@noob\_17](https://forum.suricata.io/u/noob_17)\
**Post date:** [October 27, 2022, 9:49am UTC](https://forum.suricata.io/t/still-seeing-a-lot-of-pkt-on-wrong-thread/2819/3 "2022-10-27T09:49:19Z")

</div>

I configured a bond interface and the issue is apparently gone

---

<div class="post-metadata">

**Author:** ![syoc](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@syoc](https://forum.suricata.io/u/syoc)\
**Post date:** [November 1, 2022, 3:07pm UTC](https://forum.suricata.io/t/still-seeing-a-lot-of-pkt-on-wrong-thread/2819/4 "2022-11-01T15:07:29Z")

</div>

Do get your traffic from a fiber tap? Suricata does not like getting RX and TX on different interfaces without autofp.

---

<div class="post-metadata">

**Author:** ![abigyellowdog](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/abigyellowdog/32/1277_2.png) [@abigyellowdog](https://forum.suricata.io/u/abigyellowdog)\
**Post date:** [November 6, 2022, 4:08am UTC](https://forum.suricata.io/t/still-seeing-a-lot-of-pkt-on-wrong-thread/2819/5 "2022-11-06T04:08:37Z")

</div>

It is OK, I do some test.  
Just use IPS mode for IDS if taffic from optical tap will resolve this problem (set copy-mode: ips in af-packet interface ,maybe lower performance, only plug rx fiber on 2 transceiver to receive, use “ip link set eth1 promisc on arp off up” )