AF-PACKET¶
AF-PACKET is built into the Linux kernel and includes fanout capabilities enabling it to act as a flow-based load balancer. This means, for example, if you configure Suricata for 4 AF-PACKET threads then each thread would receive about 25% of the total traffic that AF-PACKET is seeing.
Warning
If you try to test AF-PACKET fanout using tcpreplay locally, please note that load balancing will not work properly and all (or most) traffic will be handled by the first worker in the AF-PACKET cluster. If you need to test AF-PACKET load balancing properly, you can run tcpreplay on another machine connected to your AF-PACKET machine.
The following processes use AF-PACKET for packet acquisition:
VLAN tags¶
Warning
Please note that Zeek and Stenographer should correctly analyze traffic on a VLAN but won’t log the actual VLAN tags due to the way that AF-PACKET works:
More Information¶
See also
For more information about AF-PACKET, please see: