Linux bridge off a bond - will Suricata be any good?

Help
1

Hi guys.
By “any good” I mean will Suricata work in some/any way/mode in such a setup?
Bit more about the setup:

  1. there is a bond iface in broadcast mode, two physical ifaces
  2. then a bridge masters this bond, as its slave

I’m utterly new to Suricata, this would be my first deployment, a trial more accurately.
So, before I start climbing that learning-curve I hope some can answer my question?
And if the answer was to be yes, then where, into which iface Suricata should plug?
many thanks, L.

2

Can you describe the scenario with a bit more details or an example of the traffic flow?