IntroductionSuriwire is a plugin for wireshark which display suricata alert and protocol info on a pcap file inside the wireshark output. Suriwire is using Suricata’s EVE JSON log file to generate information inside Wireshark and thus is requiring at least Suricata 2.0. Suriwire has the following features:
- Display of alerts in the expert info window
- Display of alerts on a packet in the packet details
- Filter wireshark output by using signature fields such as a given sid or the content of a signature message
- Display of protocols information such as TLS and SSH in the expert info window and packet details
- Filter wireshark output using Suricata extracted protocol fields such as TLS subject DN
For example, you can filter on all TLS subject matching a string like ‘microsoft’ by using the filter suricata.tls.subject contains “microsoft”:
Latest release is version 0.2: suriwire-0.2.tar.gz.
Suriwire is hosted on github: suriwire on github.
If you are using a pre 2.x Suricata, you can use the version 0.1 of suriwire that is using the pcapinfo log file: suriwire-0.1.tar.gz
To use suriwire, copy the
suriwire.lua file in your
Optionaly, once done, you can launch wireshark and set up the
Suricata protocole (in Edit->Preferences->Protocoles->SURICATA). The only thing to do is to give the complete path to the events file.
This events file can be obtained by activating the
EVE output when doing the parsing of the pcap file you want to study with Suricata.
EVE module is currently only available in version 2.0 of Suricata.
Using suriwireAfter the opening of the pcap file in wireshark , go to Tools->Suricata->Activate: This will popup a dialog. If the events file name is correct, simply click OK. If not, enter the path of the events file. You will now be able to see suricata alerts in the detail of the packets or to search for a given alert.
Search can be done on
suricata.alert to display all the packets that have triggered an alert. If you want to search something more specific, you can use
suricata.alert.sid. Depending of what output you have enable in EVE JSON output, you can also search on events fields like