Hello,
How can I understand in which mode Suricata-IDS is running?
Thank you.
This will depend on your configuration. If using -i, --pcap or --af-packet command line options you are most likely in IDS (passive mode). If using -q or you have enabled an af-packet copy mode (disabled by default) then you are likely running in IPS mode.
Generally you’ll be in IDS mode unless you made the change to IPS mode.
No specific command to show running mode?
Since the command is something you enforce and can also be read from the suricata.log or console output.