I would like to spin up an instance of Suricata on my home network. I’ve been thinking about a few places I could put it. 1 is on my bastion host. It would be hosted inline, on the internal-facing interface. Another option would be a physical host connected to a span port on a switch. Lastly, I could stand up a VM, and pass through a Ethernet card that is span’d. What would be the best option?