Can we start suricata with the interface not present

Please include the following information with your help request:

  • Suricata version
    7.0.5
  • Operating system and/or Linux distribution
    Linux
  • How you installed Suricata (from source, packages, something else)
    Compiled the Source code.

During a reboot, we wanted to start Suricata immediately without the interface mentioned being present and when the interface is created the Suricata to retry.
Is this possible ?

For e.g: suricata -i eth0 and other option will be given. The Eth0 takes time to be created. But the requirement is to have the daemon started and start listening on Eth0 once created.

No, this isn’t possible but there are solutions available within Linux to couple the creation of a device with an action – udev rules.