Start suricate with multiple (not running) interfaces

Hello,

I recently start using Suricata 6.0.9 on my MacBook and because I use it via different NICs (Wi-Fi, LAN, VPN) I start it with this commands:

if=$(route -n get 0.0.0.0 2>/dev/null | awk ‘/interface: / {print $2}’)
sudo suricata -D -c /usr/local/etc/suricata/suricata.yaml -s /usr/local/var/lib/suricata/rules/suricata.rules -i $if

So I check the current network interface and use it for suricata. As I am switching between private usage, VPN and office, I have to do this at least two times per day. :frowning:

Lately I thought it should be possible to tell suricata all possible interfaces and tried this:

sudo suricata -D -c /usr/local/etc/suricata/suricata.yaml -s /usr/local/var/lib/suricata/rules/suricata.rules -i en0 -i en6 -i utun3

But of course it doesn’t work:

30/11/2022 – 17:10:05 - - [ERRCODE: SC_ERR_SYSCALL(50)] - Failure when trying to get MTU via ioctl for ‘en6’: Device not configured (6)
30/11/2022 – 17:10:05 - - [ERRCODE: SC_ERR_SYSCALL(50)] - Failure when trying to get MTU via ioctl for ‘utun3’: Device not configured (6)

I know this is a “specific environment”, but at least I can ask:
Is there any solution to start suricata with all interfaces, regardless if they are running/available during start time?

Thank you very much,
Lasse

1 Like

I guess it’s easier to write a script that detects a new interface being attached/used and start suricata via the script.