<html><head></head><body>If suricata is being used to monitor a network span port in IDS mode on a single network interface as well as perform IPS mode on a different set of network interfaces on the same appliance, what is the best way to configure?<div><br></div><div>Either suricata -c /etc/suricata/suricata1.yaml -i eth0 and suricata -c /etc/suricata/suricata2.yaml --af-packet or</div><div><br></div><div>suricata -c /etc/suricata/suricata.yaml --af-packet and configure af-packet to perform ips mode on one pair of ports and ids mode on the other single port.</div><div><br></div><div>Leonard</div></body></html>