i install suricata fresh on ubuntu 20.04
then i go in
i have two nic
then i add this:
- rule-reload: true`
af-packet: - interface: enp0s3 threads: 1 defrag: no cluster-type: cluster_flow cluster-id: 98 copy-mode: ips copy-iface: enp0s4 buffer-size: 64535 use-mmap: yes - interface: enp0s4 threads: 1 cluster-id: 97 defrag: no cluster-type: cluster_flow copy-mode: ips copy-iface: enp0s3 buffer-size: 64535 use-mmap: yes
now i don’t understand how to start suricata in IPS mode and add any rule to test it or is there any further configuration to start suricata in IPS mode.