Platform and capture prerequisites

Define the lab boundary

Use a dedicated Linux lab host with Suricata 8.0.1, its matching packaged configuration, local rule files and sufficient disk space. This course assumes those components are already installed. Interface names are examples: adapt them from the actual host, not from the router labels. Containers need access to the relevant interfaces and capture capabilities; a container alone does not create a mirror feed.

Check the build and interfaces

suricata --build-info
ip -br link
Suricata version 8.0.1
AF_PACKET support: yes
NFQueue support: yes
mon0             UP
mgmt0            UP

This selected-field example establishes the engine version, compiled capture support and interface names. A supported feature is not proof that traffic is reaching it. Keep the management interface outside the monitored data path.

Choose capture for the job

Do not run a service capture and a second manual capture on the same interfaces without deliberately separating their resources. Confirm which configuration and service unit the distribution starts.

Check the observation chain

Compare source-link rate and mirror capacity, NIC errors, capture drops, CPU load and storage. Packet rate and rule complexity matter as well as bandwidth. Receive aggregation and checksum offload can change what a host capture presents; review the documented settings for the selected backend rather than disabling every feature indiscriminately.

ip -s link show mon0
RX: bytes  packets  errors dropped
    98000  1000     0      0

These interface counters only cover this host. A switch may have lost mirrored packets before they arrived. Use a known bidirectional flow to validate the entire chain.

Gate the next step

Record version, capture method, selected interface, monitored networks, time synchronization, log location and rollback owner. Confirm the lab feed and storage permissions, then validate configuration syntax before processing packets. A successful syntax check cannot demonstrate mirror coverage or throughput.

suricata -T -c /etc/suricata/suricata.yaml --init-errors-fatal
Configuration provided was successfully loaded. Exiting.

The configuration can load in this example. The next lesson defines the monitored address groups; offline processing later verifies a harmless marker without touching live traffic.