efahl
4
Yeah, the gro/lro stuff is a bug fix/workaround (https://blog.snort.org/2016/08/running-snort-on-commodity-hardware.html) and doesn't do anything to performance as far as I can tell.
The interesting line of inquiry is splitting the inputs across queues, which might have some performance impact. See some of the later posts here: