https://github.com/regit/suriwire

Wireshark plugin to display Suricata analysis info
https://github.com/regit/suriwire

Last synced: 9 days ago
JSON representation

Wireshark plugin to display Suricata analysis info

• Host: GitHub
• URL: https://github.com/regit/suriwire
• Owner: regit
• License: gpl-3.0
• Created: 2011-09-28T23:12:52.000Z (about 13 years ago)
• Default Branch: master
• Last Pushed: 2021-11-05T07:46:02.000Z (about 3 years ago)
• Last Synced: 2024-08-02T07:12:45.174Z (3 months ago)
• Language: Lua
• Homepage: https://home.regit.org/software/suriwire
• Size: 174 KB
• Stars: 90
• Watchers: 4
• Forks: 15
• Open Issues: 2
• Metadata Files:
  • Readme: README.rst
  • Changelog: ChangeLog
  • License: LICENSE

Awesome Lists containing this project

• awesome-suricata - Suriwire - Wireshark plugin to display Suricata analysis info. (Misc)

README

        
========

Suriwire

========

Introduction

============

Suriwire is a plugin for wireshark that allow you to display

suricata alert and protocol information as element of the

protocol dissection.

.. image:: https://github.com/regit/suriwire/raw/master/doc/suriwire.png

    :alt: wireshark screenshot with suriwire generated info

    :align: center

Suriwire has parsing for the following events:

* Alerts

* HTTP

* fileinfo

* TLS

* SSH

* SMB

For example, the preceding screenshot shows how it is possible to search for

TLS session where the subject of the certificate matches a certain string.

Installation

============

Copy or link suriwire.lua to your wireshark plugin directory. For a user,

this is ``~/.local/lib/wireshark/plugins``  (or ``~/.wireshark/plugins/`` on

older systems).

Suriwire depends on `cjson` JSON library with a fallback on `dkjson` library.

Usage

=====

Run externally suricata on the pcap file you study to create a

suitable alert file. You need to use the ``EVE`` output format.

To specify a directory to output files to, you can use the ``-l``

flag in suricata ::

 suricata -r sample.pcap -l log/

Then you will be able to use the ``log/eve.json`` file.

In wireshark, open the pcap file and go to ``Tools->Suricata->Activate``.

Then enter the name of the EVE file. This will parse again the file adding

all Suricata generated information.

You can also indicate which EVE file to parse at start by running something

like: ::

 SURIWIRE_EVE_FILE=log2/eve.json wireshark sample.pcap

You will now find information about the alerts and other events:

* In the detail of a packet under ``Suricata analysis`` element

* In ``Analyse->Expert Info Composite``

You can also filter on the ``suricata`` protocol. The protocol has

fields like ``suricata.alert.sid`` and ``suricata.tls.subject`` which can be used

in filter.

If you reuse the same ``eve.json`` file, you can set the default path in the

protocol preferences inside wireshark.

More information on https://home.regit.org/software/suriwire.