Nicely lifted from https://github.com/Security-Onion-Solutions/security-onion/wiki/NetworkConfiguration you can also configure to start tcpdump in post-up Update: WIth netplan you can have an interface brought up without an address by adding it with an empty configuration: {} # This file describes the network