Suriwire

 

Introduction

Suriwire is a plugin for wireshark which display suricata alert and protocol info on a pcap file inside the wireshark output. Suriwire is using Suricata’s EVE JSON log file to generate information inside Wireshark and thus is requiring at least Suricata 2.0. Suriwire has the following features:
  • Display of alerts in the expert info window
  • Display of alerts on a packet in the packet details
  • Filter wireshark output by using signature fields such as a given sid or the content of a signature message
  • Display of protocols information such as TLS and SSH in the expert info window and packet details
  • Filter wireshark output using Suricata extracted protocol fields such as TLS subject DN

For example, you can filter on all TLS subject matching a string like ‘microsoft’ by using the filter suricata.tls.subject contains “microsoft”:

Screenshot from 2014-06-14 11:24:02

Download

Latest release is version 0.2: suriwire-0.2.tar.gz.

Suriwire is hosted on github: suriwire on github.

If you are using a pre 2.x Suricata, you can use the version 0.1 of suriwire that is using the pcapinfo log file: suriwire-0.1.tar.gz

Usage

Installation

To use suriwire, copy the suriwire.lua file in your ~/.wireshark/plugins/ directory.

Optionaly, once done, you can launch wireshark and set up the Suricata protocole (in Edit->Preferences->Protocoles->SURICATA). The only thing to do is to give the complete path to the events file. This events file can be obtained by activating the EVE output when doing the parsing of the pcap file you want to study with Suricata.

Note: The EVE module is currently only available in version 2.0 of Suricata.

Using suriwire

After the opening of the pcap file in wireshark , go to Tools->Suricata->Activate: suriwire-menu This will popup a dialog. If the events file name is correct, simply click OK. If not, enter the path of the events file. You will now be able to see suricata alerts in the detail of the packets or to search for a given alert.

Search can be done on suricata.alert to display all the packets that have triggered an alert. If you want to search something more specific, you can use suricata.alert.msg and suricata.alert.sid. Depending of what output you have enable in EVE JSON output, you can also search on events fields like suricata.http.user_agent or suricata.tls.issuerdn.

 Posted by at 01:07

  2 Responses to “Suriwire”

  1. [...] публичный рeлиз плaгинa для aнaлизaтoрa трaфикa Wireshark – Suriwire 0.1. Oснoвнaя зaдaчa плaгинa oтoбрaжeниe suricata-оповещений [...]

  2. Suriwire has been featured at LinuxLinks.com

 Leave a Reply

(required)

(required)

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>