Feeding Suricata from a FIFO Pipe with PCAP Data

Help
1

Have a nice day!

I have a question regarding the setup of Suricata for real-time packet analysis. I am looking to continuously feed Suricata with packets in PCAP format that are being delivered through a Linux named pipe (FIFO). I am aware that Suricata has options to feed from multiple PCAP files in the same directory, but this scenario is a bit different.

Is it feasible for Suricata to process packets from the same FIFO in an infinite loop without interruption? Any guidance or insights on how to configure this setup would be greatly appreciated.

Thank you in advance for your help!

2

I think one option would be to create a dummy0 interface to which you feed the packets (via tcpreplay for example) and use that interface as a capture interface in Suricata. You can create such dummy interfaces on LInux.