You’ll likely have to validate manually that you are getting valid streams.
I’ve used dummynet devices a lot with Suricata - I have Suricata listening on the interface while I tcpreplay a pcap into it and all is good. You may want to try similar just to verify that Suricata is seeing data on the interface (tho wireshark, tcpdump should be able to show you that)… But if that is logged correctly, you can probably narrow it down to your rewriting program.