# Localhost working but not in ethernet

**URL:** <https://forum.suricata.io/t/localhost-working-but-not-in-ethernet/5391>\
**Category:** Help\
**Tags:** ips, community, rules, suricata\
**Created:** [February 19, 2025, 6:46am UTC](https://forum.suricata.io/t/localhost-working-but-not-in-ethernet/5391 "2025-02-19T06:46:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kenpachi](https://avatars.discourse-cdn.com/v4/letter/k/87869e/32.png) [@kenpachi](https://forum.suricata.io/u/kenpachi)\
**Post date:** [February 19, 2025, 6:46am UTC](https://forum.suricata.io/t/localhost-working-but-not-in-ethernet/5391/1 "2025-02-19T06:46:58Z")

</div>

I created local rules and sent packets using Scapy. The only problem is when I used lo (localhost) the rules I created were working, but if I ran the enp0s3 (ethernet), the created rules were not found. Do I still need a config in the Suricata settings?

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [February 19, 2025, 4:22pm UTC](https://forum.suricata.io/t/localhost-working-but-not-in-ethernet/5391/2 "2025-02-19T16:22:13Z")

</div>

Can you give an example of a rule that was working with `lo`?

What version of Suricata are you using?

If the `HOME_NET` value is incorrect for `enp0s3` but valid for `lo` that may be the cause. A sample rule would help along with the value of HOME\_NET from the suricata config file `suricata.yaml`

---

<div class="post-metadata">

**Author:** ![kenpachi](https://avatars.discourse-cdn.com/v4/letter/k/87869e/32.png) [@kenpachi](https://forum.suricata.io/u/kenpachi)\
**Post date:** [February 21, 2025, 3:48am UTC](https://forum.suricata.io/t/localhost-working-but-not-in-ethernet/5391/3 "2025-02-21T03:48:08Z")

</div>

Hi @Jeff_Lucovsky  
We created our rules in Suricata, and it runs on my localhost computer. However, when we ran it on AWS, no results were displayed. We have a virtual machine instance in AWS with Suricata installed.

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [February 21, 2025, 12:53pm UTC](https://forum.suricata.io/t/localhost-working-but-not-in-ethernet/5391/4 "2025-02-21T12:53:57Z")

</div>

There are many differences between the 2 environments.

I suggest you use a packet sniffing tool `tcpdump -i <interface>` on your AWS instance and verify that the monitoring traffic is being received as intended.

My questions from my initial response are still open.

---

<div class="post-metadata">

**Author:** ![kenpachi](https://avatars.discourse-cdn.com/v4/letter/k/87869e/32.png) [@kenpachi](https://forum.suricata.io/u/kenpachi)\
**Post date:** [February 21, 2025, 3:53pm UTC](https://forum.suricata.io/t/localhost-working-but-not-in-ethernet/5391/5 "2025-02-21T15:53:26Z")

</div>

The HOME\_NET value is the same as the enp0s3 interface value. Also, I already set the enp0s3 to the af-packet in the suricata.yaml

---

<div class="post-metadata">

**Author:** ![kenpachi](https://avatars.discourse-cdn.com/v4/letter/k/87869e/32.png) [@kenpachi](https://forum.suricata.io/u/kenpachi)\
**Post date:** [February 21, 2025, 4:01pm UTC](https://forum.suricata.io/t/localhost-working-but-not-in-ethernet/5391/6 "2025-02-21T16:01:47Z")

</div>

I will try your suggestion. Thank you!