suricata: Start capture first and then load rules