I am using Suricata on Ubuntu 20 to monitor an interface. When i run tcpdump on the same interface , tcpdump returns “unknown ip 0”. The same is when i use tshark.
with tshark I get the response:
1 0.000000000 N/A → N/A N/A 74 Raw packet data
When I stop Suricata , and i run both tcpdump and tshark simultaneously there is no issue.
Suricata is configured to AF_Packet Mode.
Is this expected behavior, and if yes why or am I missing something in the configuration?
Any advice is appreciated