@ish Have you heard or tried running suricata in af-packet mode on dummy interfaces in production?
I am considering some architecture that uses this option in order to alleviate the following known bug: Suricata behind proxy server - #8 by Knight (Suricata behined proxy)…