IDS For Bridged Interface

Help
1

Hello,

I am using suricata 7.0.8 in IDS mode on Oracle Linux 9 installed from oracle repository.
VM where suricata is installed, have multiple interfaces. Out of which, eth0 has IPv4 address. While ETH2 and ETH3 are connected through bridged interface “br_0” - so they won’t have IPv4 address. If I wanted to monitor ETH2 and ETH3 what configuration should I do? Or should I monitor br interface? And if yes, should I use 192.168.0.1 in command line and 192.168.0.1/24 in suricata.yaml HOME_NET?

39: br_0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 02:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
inet 192.168.0.1/24 scope global br_0
valid_lft forever preferred_lft forever

Thanks in advance!

2

You don’t need any IP configured for Suricata if you just want to passively listen.
You can also listen on br0 if needed.