Suricata: in_iface is the sensor interface

The interface is on the sensor

A record can include in_iface, a short name such as eth0 for the interface the sensor was reading. That name is local to the sensor. It is not a hostname, and it is not an address from the packet.

If the field is absent, write “in_iface not on this row.” Do not fill it with a name from the lab diagram.

The client address is a different field

src_ip, when present, is an address in the traffic the record describes. A draft that says the client is eth0 has swapped the sensor’s interface for that address. The interface can be eth0 while the client address is something else entirely.

Two sensors can both use the name eth0. The name does not tell you which sensor unless you also have the host that wrote the file, recorded as its own field.

What to file

File in_iface as the interface name, src_ip as the address, and the writer only if that field is on the row. Do not use the interface name in a sentence about who sent the packet.

Worked case: eth0 named as the client

A lab row shows in_iface eth0 and src_ip 10.8.0.21. A draft says the client is eth0 because that is the only short name on the row, and never copies the address.

The note says eth0 is the interface name on the sensor and 10.8.0.21 is the source address in the traffic. The client in the finding is the address. The interface name stays a sensor detail.

in_iface: eth0
src_ip: 10.8.0.21
write: interface eth0, source address 10.8.0.21
not: the client is eth0