# Suricata: Handling dynamic/virtual network interfaces at runtime

**URL:** <https://forum.suricata.io/t/suricata-handling-dynamic-virtual-network-interfaces-at-runtime/6271>\
**Category:** Help\
**Tags:** suricata\
**Created:** [April 17, 2026, 12:01pm UTC](https://forum.suricata.io/t/suricata-handling-dynamic-virtual-network-interfaces-at-runtime/6271 "2026-04-17T12:01:44Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tardzenyuy\_Desmond](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/tardzenyuy_desmond/32/3893_2.png) [@Tardzenyuy\_Desmond](https://forum.suricata.io/u/Tardzenyuy_Desmond)\
**Post date:** [April 17, 2026, 12:01pm UTC](https://forum.suricata.io/t/suricata-handling-dynamic-virtual-network-interfaces-at-runtime/6271/1 "2026-04-17T12:01:44Z")

</div>

Hi all. While integrating Suricata with Wazuh, we built a custom image and use the following startup script:

```bash
#!/bin/bash
set -eu

IFACES=($(ls /sys/class/net | grep -v lo))

args=()
for i in "${IFACES[@]}"; do
    args+=( -i "$i" )
done

echo /opt/wazuh/suricata/bin/suricata "${args[@]}" "$@"
exec /opt/wazuh/suricata/bin/suricata "${args[@]}" "$@"

```

We have a similar approach for macOS.  
The issue is that this picks up _all_ interfaces, including transient/virtual ones created by tools like Docker, VMware, Tailscale, etc. At startup, Suricata attaches to many of these, but some disappear later, leading to warnings like:

```auto
W: af-packet: <iface>: can't reopen interface

```

Example (trimmed):

```auto
-i br-xxx -i docker0 -i enp0s31f6 -i tailscale0 -i vethXXX -i vmnet1 ...

```

My question:  
👉 Does Suricata provide a native way to:

- Monitor only _active_ interfaces at runtime, or
- Automatically drop interfaces that go down after startup?

Or is the recommended approach to handle interface filtering externally.

Would appreciate any best practices or patterns others are using in similar setups.