# Suricata packet seen on wrong thread
**URL:** https://forum.suricata.io/t/suricata-packet-seen-on-wrong-thread/1386
**Category:** Help
**Created:** [May 24, 2021, 2:16pm UTC](https://forum.suricata.io/t/suricata-packet-seen-on-wrong-thread/1386 "2021-05-24T14:16:49Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Nuno\_Santos](https://forum.suricata.io/u/Nuno_Santos)
#### Post date: [May 24, 2021, 2:16pm UTC](https://forum.suricata.io/t/suricata-packet-seen-on-wrong-thread/1386/1 "2021-05-24T14:16:49Z")
Hi!
The field tcp packet seen on wrong thread is critical for the correct functioning of the tool?
---
### Author:  [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [May 26, 2021, 9:23pm UTC](https://forum.suricata.io/t/suricata-packet-seen-on-wrong-thread/1386/2 "2021-05-26T21:23:19Z")
This can be an issue, yes. I would recommend the following discussion: [Support #2725: stream/packet on wrong thread - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/issues/2725)
tl;dr packets might not be inspected in such a case
---
### Author:  [@Nuno\_Santos](https://forum.suricata.io/u/Nuno_Santos)
#### Post date: [May 27, 2021, 10:51am UTC](https://forum.suricata.io/t/suricata-packet-seen-on-wrong-thread/1386/3 "2021-05-27T10:51:28Z")
The problem is that I have a low-end network card (NetXtreme II BCM5709 Gigabit Ethernet). I can´t make all that optimization.
---
### Author:  [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [May 27, 2021, 7:36pm UTC](https://forum.suricata.io/t/suricata-packet-seen-on-wrong-thread/1386/4 "2021-05-27T19:36:27Z")
You could try autofp mode. How does your configuration look like currently?
---
### Author:  [@Nuno\_Santos](https://forum.suricata.io/u/Nuno_Santos)
#### Post date: [May 27, 2021, 7:46pm UTC](https://forum.suricata.io/t/suricata-packet-seen-on-wrong-thread/1386/5 "2021-05-27T19:46:56Z")
This is my config.
[suricata copy.yaml](https://forum.suricata.io/uploads/short-url/rB6XXgjsDtmIzG6GPLvBXF4yc96.yaml) (74.5 KB)
Autofp mode gives my a lot bigger number of kernel drops.
Some stats…
---
### Author:  [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [May 27, 2021, 8:29pm UTC](https://forum.suricata.io/t/suricata-packet-seen-on-wrong-thread/1386/6 "2021-05-27T20:29:06Z")
So you use 3 interfaces, can you check if the issue is gone if you use only one interface? and afterwards enable just specific ones?
Overall we have no perfect solution to this issue yet.
---
### Author:  [@Nuno\_Santos](https://forum.suricata.io/u/Nuno_Santos)
#### Post date: [May 27, 2021, 8:41pm UTC](https://forum.suricata.io/t/suricata-packet-seen-on-wrong-thread/1386/7 "2021-05-27T20:41:24Z")
I can confirm that using only one interface, the issue is gone. Autofp mode resolves the issue aswell but gives me a larger number of drops
---
### Author:  [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [May 27, 2021, 9:22pm UTC](https://forum.suricata.io/t/suricata-packet-seen-on-wrong-thread/1386/8 "2021-05-27T21:22:14Z")
You could try to check what options the NIC offers via ethtool.
Also worth a try to check if there is a NIC combination that would work, could be also worth to check different order in the configuration settings.
---
### Author:  [@syoc](https://forum.suricata.io/u/syoc)
#### Post date: [May 28, 2021, 9:01am UTC](https://forum.suricata.io/t/suricata-packet-seen-on-wrong-thread/1386/9 "2021-05-28T09:01:40Z")
Could packets in a single flow be split among the interfaces? What are the traffic sources for your 3 interfaces?
---
### Author:  [@Nuno\_Santos](https://forum.suricata.io/u/Nuno_Santos)
#### Post date: [May 28, 2021, 1:07pm UTC](https://forum.suricata.io/t/suricata-packet-seen-on-wrong-thread/1386/10 "2021-05-28T13:07:25Z")
One of the interfaces is mirroring internet traffic (outside). The other two are mirroring inside traffic, some special networks and VRF traffic
---
### Author:  [@syoc](https://forum.suricata.io/u/syoc)
#### Post date: [May 31, 2021, 1:16pm UTC](https://forum.suricata.io/t/suricata-packet-seen-on-wrong-thread/1386/11 "2021-05-31T13:16:46Z")
Is the mirroring done using for example switch span ports or physical fiber taps?
You could try to run 3 tcpdump sessions, one on each interface, and look at the pcaps in wireshark. Out of order packets or sessions being split between interfaces might be highlighted as broken sessions in wireshark.