Suriwire is a plugin for wireshark
which display suricata
alert on a pcap file inside the wireshark output.
Suriwire has the following features:
- Display of alerts in the expert info window
- Display of alerts on a packet in the packet details
- Filter wireshark output by using signature fields such as a given sid or the content of a signature message
Suriwire is hosted on github: suriwire on github
To use suriwire, copy the
file in your
directory. Launch wireshark and set up the
protocole (in Edit->Preferences->Protocoles->SURICATA). The only thing to do is to give the complete path to the alert file.
For now, this alert file can be obtained by activating the
output when doing the parsing of the pcap file you want to study with suricata.
module is currently only available in the git version of suricata.
After the opening of the pcap file in wireshark , go to Tools->Suricata->Activate. This will popup a dialog. If the alert file is correct, simply click OK. If not, enter the patch of the alert file.
You will now be able to see suricata alerts in the detail of the packets or to search for a given alert. Search can be done on
to display all the packets that have triggered an alert. If you want to search something more specific, you can use