Tcpdump on same interface as Suricata shows no IP addresses

Help
1

Hi,
I am using Suricata on Ubuntu 20 to monitor an interface. When i run tcpdump on the same interface , tcpdump returns “unknown ip 0”. The same is when i use tshark.
with tshark I get the response:

1 0.000000000 N/A → N/A N/A 74 Raw packet data

When I stop Suricata , and i run both tcpdump and tshark simultaneously there is no issue.

Suricata is configured to AF_Packet Mode.

Is this expected behavior, and if yes why or am I missing something in the configuration?

Any advice is appreciated

Thanks

2

How do you run tcpdump and suricata exactly?

I do the same (running tcpdump while Suricata running) and can’t confirm that.