By “any good” I mean will Suricata work in some/any way/mode in such a setup?
Bit more about the setup:
- there is a bond iface in broadcast mode, two physical ifaces
- then a bridge masters this bond, as its slave
I’m utterly new to Suricata, this would be my first deployment, a trial more accurately.
So, before I start climbing that learning-curve I hope some can answer my question?
And if the answer was to be yes, then where, into which iface Suricata should plug?
many thanks, L.