Dinamically change interfaces

Help
5

Unfortunately, i had no luck.
What i did is:

  • In the suricata.yaml file i added the multi-detect section. Then, I started suricata with --af-packet option.
  • Changed the suricata.yaml file adding in the af-packet section the interface i wanted to start monitoring
  • Registered a new tenant using suricatasc -c "register-tenant 1 tenant1.yaml", and i received this kind of message: {"message": "adding tenant succeeded", "return": "OK"}
  • Tried to send a packet in order to use the new interface, but in the eve.json file nothing refers to that interface.