I suggest a different way of dealing with the ENOBUFS case here https://github.com/inliniac/suricata/commit/874f5a913e6c70efc562e514525c02a82487c789