I want to use tshark because I need to capture pcap using BPF filter, time duration, file size and etc.
If I can dump a pcap with suricata and set such limits, I can use suricata.
And I want to know, as I asked at the beginning, that when I install suricata with default settings, suricata use the napatech API.