We integrated Suricata 6.0.9 into the docker, here is the issue we met.
We are using Suricata (pfring mode) to monitor NIC interface, when the the monitored interface is down (remove the network cable or CLI ‘ip link set dev eth0 down’), Suricata container fail to startup, so the container is inoperatable.
My questions are:
- For single monitored interface, can Suricata start successfully even if the interface is down?
- For multiple monitored interfaces, can Suricata start successfully when some of the interfaces are down (at least one interface is alive)
Thanks a lot!