Suricata alerts after interface change

[lylybr]

Hi everyone,

I recently changed the interface layout on my OPNsense firewall and noticed something I did not expect with Suricata IDS.

Before the change, Suricata was monitoring my LAN interface and the alerts were easy to associate with traffic from my internal clients. After moving the IDS configuration to another interface, I still see Suricata running and processing traffic, but the number of alerts has dropped significantly.

For example, normal DNS and HTTP/HTTPS traffic is visible in the firewall logs, but some traffic that previously generated Suricata alerts no longer appears in the IDS event list.

My setup is roughly:

OPNsense 26.x
Suricata enabled in IDS mode
ET Open rules enabled
LAN and an additional interface are being monitored
No custom Suricata rules
Hardware offloading is disabled

Is there a specific interface or Home Networks configuration I should check when moving Suricata monitoring between interfaces?

I'm especially interested in understanding whether the interface selection changes which traffic Suricata can actually inspect, rather than simply affecting what is displayed in the alerts.

If anyone has a similar setup, I'd appreciate hearing how you configured the monitored interfaces and Home Networks.

[cheetahcreepy]

Hey everyone! It hurts me too that Suricata alerts started going off after I changed the interface. I just read this thread about it. Like you, I felt like everyone was out to get me when I recently changed the settings on my router. It's interesting how these kinds of changes can make our setups act in strange ways. What struck me is how important it is to keep a close eye on the logs during those times.