diff --git a/src/detection/cpu/cpu_bsd.c b/src/detection/cpu/cpu_bsd.c
index bf1f29394..5c74ebf54 100644
--- a/src/detection/cpu/cpu_bsd.c
+++ b/src/detection/cpu/cpu_bsd.c
@@ -1,5 +1,6 @@
 #include "cpu.h"
 #include "common/sysctl.h"
+#include "util/stringUtils.h"
 
 #include <sys/param.h>
 #if __has_include(<sys/cpuset.h>)
@@ -34,35 +35,60 @@ const char* ffDetectCPUImpl(const FFCPUOptions* options, FFCPUResult* cpu)
     if (ffSysctlGetString("hw.model", &cpu->name) != NULL)
         return "sysctlbyname(hw.model) failed";
 
-    cpu->coresPhysical = (uint16_t) ffSysctlGetInt("hw.ncpu", 1);
-    cpu->coresLogical = cpu->coresPhysical;
+    cpu->coresLogical = (uint16_t) ffSysctlGetInt("hw.ncpu", 1);
+    cpu->coresPhysical = 0;
     cpu->coresOnline = (uint16_t) ffSysctlGetInt("kern.smp.cpus", cpu->coresLogical);
 
     FF_STRBUF_AUTO_DESTROY buffer = ffStrbufCreate();
     if (ffSysctlGetString("kern.sched.topology_spec", &buffer) == NULL && buffer.length > 0)
     {
         // <groups>
-        // <group level="1" cache-level="3">
-        // <cpu count="4" mask="f,0,0,0">0, 1, 2, 3</cpu>
-        // <children>
-        // <group level="2" cache-level="2">
-        // <cpu count="2" mask="3,0,0,0">0, 1</cpu>
-        // <flags><flag name="THREAD">THREAD group</flag><flag name="SMT">SMT group</flag></flags>
-        // </group>
-        // <group level="2" cache-level="2">
-        // <cpu count="2" mask="c,0,0,0">2, 3</cpu>
-        // <flags><flag name="THREAD">THREAD group</flag><flag name="SMT">SMT group</flag></flags>
-        // </group>
-        // </children>
-        // </group>
+        //  <group level="1" cache-level="3">
+        //   <cpu count="4" mask="f,0,0,0">0, 1, 2, 3</cpu>
+        //   <children>
+        //    <group level="2" cache-level="2">
+        //     <cpu count="2" mask="3,0,0,0">0, 1</cpu>
+        //     <flags><flag name="THREAD">THREAD group</flag><flag name="SMT">SMT group</flag></flags>
+        //    </group>
+        //    <group level="2" cache-level="2">
+        //     <cpu count="2" mask="c,0,0,0">2, 3</cpu>
+        //     <flags><flag name="THREAD">THREAD group</flag><flag name="SMT">SMT group</flag></flags>
+        //    </group>
+        //   </children>
+        //  </group>
         // </groups>
-        uint32_t i = 0;
-        while (true)
+        char* line = NULL;
+        size_t len = 0;
+        bool inLvl2 = false, threadGroup = false;
+        uint32_t cpuCount = 0;
+        while (ffStrbufGetline(&line, &len, &buffer))
         {
-            i = ffStrbufNextIndexS(&buffer, i, "<flag name=\"THREAD\">THREAD group</flag>"); // Find physical core with hyper-threading enabled
-            if (i >= buffer.length) break;
-            cpu->coresPhysical--;
-            i += (uint32_t) strlen("<flag name=\"THREAD\">THREAD group</flag>");
+            if (!inLvl2)
+            {
+                if (ffStrStartsWith(line, "   <group level=\"2\""))
+                {
+                    inLvl2 = true;
+                    cpuCount = 0;
+                    threadGroup = false;
+                }
+                else if (ffStrStartsWith(line, " <group level=\"1\""))
+                    cpu->packages++;
+            }
+            else
+            {
+                if (ffStrEquals(line, "   </group>"))
+                {
+                    cpu->coresPhysical += threadGroup ? 1 : cpuCount;
+                    inLvl2 = false;
+                }
+                else if (cpuCount == 0 && ffStrStartsWith(line, "    <cpu count=\""))
+                    cpuCount = (uint32_t) strtoul(line + strlen("    <cpu count=\""), NULL, 10);
+                else if (cpuCount > 0 && ffStrStartsWith(line, "    <flags>"))
+                {
+                    if (ffStrContains(line, "<flag name=\"THREAD\">THREAD group</flag>"))
+                        threadGroup = true;
+                }
+            }
         }
     }