Suricata fail to start when the monitored interface is down

1

We integrated Suricata 6.0.9 into the docker, here is the issue we met.

We are using Suricata (pfring mode) to monitor NIC interface, when the the monitored interface is down (remove the network cable or CLI ‘ip link set dev eth0 down’), Suricata container fail to startup, so the container is inoperatable.

My questions are:

  1. For single monitored interface, can Suricata start successfully even if the interface is down?
  2. For multiple monitored interfaces, can Suricata start successfully when some of the interfaces are down (at least one interface is alive)

Thanks a lot!

2

For AF_PACKET this seems to be case. The device has to exist, but can be down and it will retry later. It doesn’t look like PF_RING has this same logic. It might be worth a feature request (Issues - Suricata - Open Information Security Foundation).

1 Like