Question about use queue mode accept

Help
,
1

I’am using Suricata in mode IPS, my intention is use run mode “accept”, directioning traffic via firewall for multi queues, that is, it doesn’t matter which interface the packet enters or leaves

My main question is if need setting really one session “af-packet” by interface in my suricata.yaml?

Other question is about cluster-id, what a problem in using same id for all interfaces?

Info:

  • Suricata v6.0.13
  • OS: Debian

Thanks

2

Do you want to run the AF_PACKET IPS mode or do you want to use the netfilter integrated mode with NFQUEUE?

The cluster-id needs to be unique.

Did you read the docs at 15. Setting up IPS/inline for Linux — Suricata 7.0.1-dev documentation to see which mode applies to your scenario?