How to set up suricata af_packet IPS mode if my laptop only have one NIC?

Help
,
1

I have a laptop with only one wireless NIC (Intel AX200) and then I want to setup a NIPS on it, and finally i choosed suricata.

I tried to create a dummy interface and a VLAN interface as the interface required in the suricata manual, but I have completely failed.

So…do you have any idea?
thanks a lot~ :slight_smile:

here are some system infomation:
OS: Gentoo Linux
Init: OpenRC 0.43.5
Kenerl: linux-5.14.9-xanmod1-cacule
Glibc: glibc-2.33-r1

2

Have you considered using the NFQUEUE mode instead?
https://suricata.readthedocs.io/en/suricata-6.0.3/setting-up-ipsinline-for-linux.html

4

Thanks for your reply. I considered using nfqueue mode, but I still wanted to try af_packet mode at that time. But now it seems that I really have to use nf_queue mode.

:laughing: so my nips is now working properly.