Using suricata as IDS for traffic from various networks via ERSPAN

[vjulien (Victor Julien)]

Sounds like something like promisc mode on the capture interface is not enabled?