# Suricata-IDS in AF\_PACKET IPS mode and IP ranges **URL:** \ **Category:** Help\ **Created:** [November 15, 2023, 11:57am UTC](https://forum.suricata.io/t/suricata-ids-in-af-packet-ips-mode-and-ip-ranges/4191 "2023-11-15T11:57:11Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\ **Post date:** [November 15, 2023, 11:57am UTC](https://forum.suricata.io/t/suricata-ids-in-af-packet-ips-mode-and-ip-ranges/4191/1 "2023-11-15T11:57:11Z")
Hello, Please consider the figure below. ```auto Client ---> Suricata-IDS ---> Server ``` I ran Suricata with the following command: `# suricata --af-packet -D` Why should the client and server have the same IP address range? I set the IP address `192.168.1.2` for the client and `172.21.50.2` for the server, but the client and server could not see each other! Is there anything in the Suricata-IDS config file to fix this? Thank you. ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [November 15, 2023, 3:22pm UTC](https://forum.suricata.io/t/suricata-ids-in-af-packet-ips-mode-and-ip-ranges/4191/2 "2023-11-15T15:22:43Z")
AF\_PACKET IPS forms a bridge, I think we have gone over this ad nauseam… A bridge is like twisting the wires together, not a router. Using Suricata in AF\_PACKET IPS mode is much like connecting the 2 ethernet cables with a coupler like below. ![2023-11-15T09:21:56,709488275-06:00](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/a/aa8ad0f722d3dd0aec6972d28c729b1fad15003c.png) ---
**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\ **Post date:** [November 16, 2023, 7:47pm UTC](https://forum.suricata.io/t/suricata-ids-in-af-packet-ips-mode-and-ip-ranges/4191/3 "2023-11-16T19:47:25Z")
Hello, Thank you so much for your reply. So, in what mode can Suricata-IDS do this? Can Suricata-IDS do such a thing? ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [November 16, 2023, 7:48pm UTC](https://forum.suricata.io/t/suricata-ids-in-af-packet-ips-mode-and-ip-ranges/4191/4 "2023-11-16T19:48:23Z")
Not really. Linux iptables/nftables can. Then you augment iptables/nftables with Suricata for IPS support. ---
**Author:** ![Hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@Hack3rcon](https://forum.suricata.io/u/Hack3rcon)\ **Post date:** [November 16, 2023, 7:56pm UTC](https://forum.suricata.io/t/suricata-ids-in-af-packet-ips-mode-and-ip-ranges/4191/5 "2023-11-16T19:56:06Z")
Thanks. So, should I use Suricata-IDS in `NFQ mode` or I can use Suricata-IDS in `AF_PACKET IPS mode`, but I should use iptables/nftables to connect two different ranges of IP addresses? ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [November 16, 2023, 8:04pm UTC](https://forum.suricata.io/t/suricata-ids-in-af-packet-ips-mode-and-ip-ranges/4191/6 "2023-11-16T20:04:16Z")
Please review all your other threads on this topic. NFQ and AF\_PACKET IPS modes are fundamentally different and usually the choice is based on the topology of your network - which we’ve covered in detail already. We can’t decide which you need, this is the level of networking knowledge you have to bring to Suricata. I’m going to re-suggest my old advice. Place a machine where you want the packets to flow through. Get it working first, either with IPtables or Linux bridge. When you are happy, then bring in Suricata. Don’t complicate the basics with Suricata first.