{"id":13531085,"url":"https://github.com/regit/suriwire","last_synced_at":"2025-10-26T20:07:28.125Z","repository":{"id":141524958,"uuid":"2478657","full_name":"regit/suriwire","owner":"regit","description":"Wireshark plugin to display Suricata analysis info","archived":false,"fork":false,"pushed_at":"2021-11-05T07:46:02.000Z","size":178,"stargazers_count":93,"open_issues_count":2,"forks_count":12,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-03-21T23:34:09.108Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://home.regit.org/software/suriwire","language":"Lua","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/regit.png","metadata":{"files":{"readme":"README.rst","changelog":"ChangeLog","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2011-09-28T23:12:52.000Z","updated_at":"2025-01-13T02:42:01.000Z","dependencies_parsed_at":"2024-01-24T12:56:17.934Z","dependency_job_id":null,"html_url":"https://github.com/regit/suriwire","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/regit%2Fsuriwire","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/regit%2Fsuriwire/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/regit%2Fsuriwire/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/regit%2Fsuriwire/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/regit","download_url":"https://codeload.github.com/regit/suriwire/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245670940,"owners_count":20653455,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T07:00:59.768Z","updated_at":"2025-10-26T20:07:23.071Z","avatar_url":"https://github.com/regit.png","language":"Lua","funding_links":[],"categories":["Misc"],"sub_categories":[],"readme":"========\nSuriwire\n========\n\nIntroduction\n============\n\nSuriwire is a plugin for wireshark that allow you to display\nsuricata alert and protocol information as element of the\nprotocol dissection.\n\n.. image:: https://github.com/regit/suriwire/raw/master/doc/suriwire.png\n    :alt: wireshark screenshot with suriwire generated info\n    :align: center\n\nSuriwire has parsing for the following events:\n\n* Alerts\n* HTTP\n* fileinfo\n* TLS\n* SSH\n* SMB\n\nFor example, the preceding screenshot shows how it is possible to search for\nTLS session where the subject of the certificate matches a certain string.\n\nInstallation\n============\n\nCopy or link suriwire.lua to your wireshark plugin directory. For a user,\nthis is ``~/.local/lib/wireshark/plugins``  (or ``~/.wireshark/plugins/`` on\nolder systems).\n\nSuriwire depends on `cjson` JSON library with a fallback on `dkjson` library.\n\nUsage\n=====\n\nRun externally suricata on the pcap file you study to create a\nsuitable alert file. You need to use the ``EVE`` output format.\nTo specify a directory to output files to, you can use the ``-l``\nflag in suricata ::\n\n suricata -r sample.pcap -l log/\n\nThen you will be able to use the ``log/eve.json`` file.\n\nIn wireshark, open the pcap file and go to ``Tools-\u003eSuricata-\u003eActivate``.\nThen enter the name of the EVE file. This will parse again the file adding\nall Suricata generated information.\n\nYou can also indicate which EVE file to parse at start by running something\nlike: ::\n\n SURIWIRE_EVE_FILE=log2/eve.json wireshark sample.pcap\n\nYou will now find information about the alerts and other events:\n\n* In the detail of a packet under ``Suricata analysis`` element\n* In ``Analyse-\u003eExpert Info Composite``\n\nYou can also filter on the ``suricata`` protocol. The protocol has\nfields like ``suricata.alert.sid`` and ``suricata.tls.subject`` which can be used\nin filter.\n\nIf you reuse the same ``eve.json`` file, you can set the default path in the\nprotocol preferences inside wireshark.\n\nMore information on https://home.regit.org/software/suriwire.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fregit%2Fsuriwire","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fregit%2Fsuriwire","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fregit%2Fsuriwire/lists"}