Alert for unidirectional traffic

1

I have some Suricata systems running off of taps, others off of mirror ports. Occasionally, something will happen where by we only get one side of the traffic. That is, I either see the receive traffic or the transmit traffic, but not both.

Is there a way to have Suricata alert or log something that indicates this is happening?

2

There is no built-in function, but you can use tshark to do some analysis on that, see 11.11. Performance Analysis — Suricata 8.0.0-dev documentation but you would have to script around it.