# A question about Suricata-IDS in monitoring mode

**URL:** <https://forum.suricata.io/t/a-question-about-suricata-ids-in-monitoring-mode/4212>\
**Category:** Help\
**Created:** [November 22, 2023, 9:36am UTC](https://forum.suricata.io/t/a-question-about-suricata-ids-in-monitoring-mode/4212 "2023-11-22T09:36:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\
**Post date:** [November 22, 2023, 9:36am UTC](https://forum.suricata.io/t/a-question-about-suricata-ids-in-monitoring-mode/4212/1 "2023-11-22T09:36:26Z")

</div>

Hello,  
When  
When we run Suricata-IDS using `suricata -i NIC`, can it connect two NICs like in `AF_PACKET IPS` mode?

Thank you.

---

<div class="post-metadata">

**Author:** ![lukashino](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/lukashino/32/1150_2.png) [@lukashino](https://forum.suricata.io/u/lukashino)\
**Post date:** [November 22, 2023, 10:19am UTC](https://forum.suricata.io/t/a-question-about-suricata-ids-in-monitoring-mode/4212/2 "2023-11-22T10:19:37Z")

</div>

no, you need to use suricata.yaml config for this use-case as in IPS mode.

---

<div class="post-metadata">

**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\
**Post date:** [November 24, 2023, 4:54pm UTC](https://forum.suricata.io/t/a-question-about-suricata-ids-in-monitoring-mode/4212/3 "2023-11-24T16:54:18Z")

</div>

Hello,  
Thank you so much.  
So, does Suricata-IDS only have this capability in IPS mode?

---

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [November 24, 2023, 5:09pm UTC](https://forum.suricata.io/t/a-question-about-suricata-ids-in-monitoring-mode/4212/4 "2023-11-24T17:09:04Z")

</div>

You can list multiple interfaces under the `af-packet` section for IDS/monitoring mode as well. And you can specify `-i` multiple times on the command line as well. Sometimes its worth just trying to see if something works.

---

<div class="post-metadata">

**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\
**Post date:** [December 6, 2023, 6:46am UTC](https://forum.suricata.io/t/a-question-about-suricata-ids-in-monitoring-mode/4212/5 "2023-12-06T06:46:41Z")

</div>

Hello,  
Thanks.  
Does Suricata-IDS only have this capability in IPS mode? Or I can connect two NICs in monitoring mode too, but I must define them under the `af-packet` section?