A question about Suricata-IDS in monitoring mode

Help
1

Hello,
When
When we run Suricata-IDS using suricata -i NIC, can it connect two NICs like in AF_PACKET IPS mode?

Thank you.

2

no, you need to use suricata.yaml config for this use-case as in IPS mode.

1 Like
3

Hello,
Thank you so much.
So, does Suricata-IDS only have this capability in IPS mode?

4

You can list multiple interfaces under the af-packet section for IDS/monitoring mode as well. And you can specify -i multiple times on the command line as well. Sometimes its worth just trying to see if something works.

1 Like
5

Hello,
Thanks.
Does Suricata-IDS only have this capability in IPS mode? Or I can connect two NICs in monitoring mode too, but I must define them under the af-packet section?