6 ms·

Show HN: Stratoshark, a sibling application to Wireshark

321 points by geraldcombs 2y ago

Hi all, I'm excited to announce Stratoshark, a sibling application to Wireshark that lets you capture and analyze process activity (system calls) and log messages in the same way that Wireshark lets you capture and analyze network packets. If you would like to try it out you can download installers for Windows and macOS and source code for all platforms at https://stratoshark.org https://stratoshark.org. AMA: I'm the goofball whose name is at the top of the "About" box in both applications, and I'll be happy to answer any questions you might have.

napolux 2y ago
having used wireshark since i was a kid... this looks really promising
- Chihuahua0633 2y ago
  Do you have any wildly good Wireshark resources to reference -- I know I'm barely scratching the surface.
  - 12bits 2y ago
    https://www.youtube.com/@ChrisGreer https://www.youtube.com/@ChrisGreer if you are into video format.
    - geraldcombs 2y ago
      Chris is definitely a good resource! We (the Wireshark Foundation) also have SharkFest session recordings up at https://www.youtube.com/@WireSharkFest https://www.youtube.com/@WireSharkFest
n1g3ld0uglas2 2y ago
Being able to use Wireshark in Kubernetes is super exciting. I can't wait to get started!
mdaniel 2y ago
clickable link: https://stratoshark.org https://stratoshark.org I found its man page in the repo which I found insightful https://gitlab.com/wireshark/wireshark/-/blob/ssv0.9.0/doc/man_pages/stratoshark.adoc?ref_type=tags https://gitlab.com/wireshark/wireshark/-/blob/ssv0.9.0/doc/m... and don't overlook this neato thing: https://gitlab.com/wireshark/wireshark/-/blob/ssv0.9.0/doc/man_pages/sshdig.adoc?ref_type=tags https://gitlab.com/wireshark/wireshark/-/blob/ssv0.9.0/doc/m...
westurner 2y ago
Re: custom fields in pcap traces and retis https://github.com/retis-org/retis https://github.com/retis-org/retis
freedomben 2y ago
Long, long time user of Wireshark and I instantly recognize your name. Thank you for all the great work over the years :-) Looks really awesome! I didn't see Linux installation instructions so clicked on the link to the source code, but it links to the Wireshark source[1]. Is Stratoshark part of the same repo as Wireshark? Is Linux supported by Stratoshark? [1]: https://gitlab.com/wireshark/wireshark https://gitlab.com/wireshark/wireshark
- geraldcombs 2y ago
  Thanks! It's part of the same code base (and therefore open source), and Linux is definitely supported. It adds libscap and libsinsp as dependencies, and you can find basic build instructions at https://gitlab.com/wireshark/wireshark/-/blob/master/doc/stratoshark-quick-start.adoc https://gitlab.com/wireshark/wireshark/-/blob/master/doc/str....
imcritic 2y ago
Can this program do more than just observe and trace what happens? Can one use it to set up some rule to suppress some of the syscalls sent to a specific process? Or alter them by some logic on the go?
- geraldcombs 2y ago
  It's currently only passive, but that'd be an interesting feature. In order for that to happen we'd have to add that functionality to https://github.com/falcosecurity/libs/ https://github.com/falcosecurity/libs/ along with the necessary plumbing in the UI.
pimlottc 2y ago
The first section on the homepage doesn’t give me a good sense of what the application does. The references to Wireshark suggest it has something to do with network traffic but that doesn’t seem to be the case. It also talks about cloud but nothing seems to be cloud-specific?
- gertrunde 2y ago
  The blog article is a bit more descriptive : https://sysdig.com/blog/stratoshark-extending-wiresharks-legacy-into-the-cloud/ https://sysdig.com/blog/stratoshark-extending-wiresharks-leg... tl;dr version: system calls, but in the wireshark ui. (I've probably oversimplified that!)
  - vasco 2y ago
    Thanks for your work! Been using Wireshark for many years after it was used for a network course in university. Why do you focus on "what happens in your cloud" when we talk about system calls? It'd seem it's useful for any machine, is it just bad marketing copy or am I missing something?
    - geraldcombs 2y ago
      You're welcome! It was initially developed as part of my day job at Sysdig, a cloud security company. The initial feature set and use cases focus on getting .scaps (system call and log captures) from cloud environments, but you're entirely correct -- this has much more general applications including troubleshooting and education just like Wireshark does on the networking side.
      - vasco 2y ago
        Thanks for confirming and thanks again for the amazing work.
      - kristopolous 2y ago
        Hey Gerald, It's Chris from the CACE days. Nice to hear from you. I see this is part of wireshark proper, I'll look into getting this into debian
observationist 2y ago
The OP URL has been flagged as grayware by Palo Alto and is thus inaccessible to a large number of people, possibly indicating typosquatting, or being miscategorized? https://wiki.wireshark.org/Stratoshark https://wiki.wireshark.org/Stratoshark is a good link for those who can't reach the stratoshark URL directly. The OP link may get recategorized and become accessible in the meantime.
- geraldcombs 2y ago
  Well, crap. The domain and site are still fairly new, so maybe that's the issue? Is there anyone here from Palo Alto that can take a look?
  - observationist 2y ago
    Going through their URL filtering site and requesting a recategorization is the best option for now, unless someone from the company sees it. https://urlfiltering.paloaltonetworks.com/ https://urlfiltering.paloaltonetworks.com/
    - geraldcombs 2y ago
      Done. We've been upgraded from medium-risk "grayware" to low-risk "generally do not contain content that is useful to the end user" which is technically better, I suppose. Update: We're now Low-Risk / Computer-and-Internet-Info.
clbrmbr 2y ago
Wireshark is to tcpdump as stratoshark is to strace. Did I get the analogy right?
- geraldcombs 2y ago
  Pretty much. It's part of the same ecosystem as Sysdig OSS[1], which works much like strace. It uses the same underlying libraries as sysdig and Falco, and you can move capture files between them. It'd be interesting to see if we can integrate more fully with strace as well, but that might require updating strace itself. [1]https://github.com/draios/sysdig https://github.com/draios/sysdig
  - IshKebab 2y ago
    Why is it talking about clouds and stratospheres then? strace is pretty far from "the cloud" isn't it?
    - uhei 2y ago
      With the falco plugins [1] a broad range of "cloud native" services can be captured in Stratoshark. At the moment we have AWS cloudtrail and GCP Audit included in the macOS and Win installers. [1] https://github.com/falcosecurity/plugins?tab=readme-ov-file#registered-plugins https://github.com/falcosecurity/plugins?tab=readme-ov-file#...
brutopia 2y ago
How does it trace syscalls on macos? Do you need to disable SIP?
- deleted 2y ago
  [deleted]
- geraldcombs 2y ago
  Right now the UI runs on Windows, macOS, and Linux but you can only capture system calls on Linux via Falco libs[1]. Expanding local capture to include macOS and Windows is definitely something we'd love to do! [1]https://github.com/falcosecurity/libs https://github.com/falcosecurity/libs
  - nikisweeting 2y ago
    Awesome! Thanks for your work on this and everything else. Once you add capture on macOS with something like dtrace, could you concievably capture a system call inside Docker on macOS and watch it trickle down through the linux hypervisor and then to the host darwin kernel and back? How does it conceptually track the handoff of system calls between hypervisors/VMs/containers/etc?
    - geraldcombs 2y ago
      In this case you would presumably have a capture file that contained syscall events at both the macOS boundary and at the Linux VM boundary. At the present time it would be like capturing traffic on either side of a firewall and loading it into Wireshark (which is something people do!) You'd have to correlate the events visually/manually but adding an automatic correlation feature is well within the realm of possibility.
      - nikisweeting 2y ago
        Yeah I was imagining something like the TLS session tracing feature in Wireshark that lets you see all the packets related to a single TLS connection. I currently struggle debugging opaque containers and VMs that run lots of concurrent async jobs, having some kind of tool to trace and group syscalls through the stack would be amazing.
tarasglek 2y ago
It is not clear what the architecture for system-call capture is. Is it ptrace, ebpf or some custom thing or some combo? What is the overhead of running this? The tool looks really cool, hopefully it moves ui state of art beyond windows xperf
- geraldcombs 2y ago
  It uses Falco libs[1] underneath, which supports capture using eBPF or a kmod. I work with the Falco libs team and they go to great lengths to minimize overhead. [1]https://github.com/falcosecurity/libs/ https://github.com/falcosecurity/libs/
zokier 2y ago
Does sysdig (and stratoshark by extension) still require custom out-of-tree kernel module to function?
- uhei 2y ago
  No, with the parameter '--modern-bpf' you can use eBPF. So, no kmod required any more.
thesuitonym 2y ago
Would I be right in assuming this is like Sysinternals procmon but with a better interface and for Linux?
- geraldcombs 2y ago
  The tools are similar in many ways, but Stratoshark shares Wireshark's dissection, filtering, and UI code, which provides a more low-level details and a free-form filtering language. Stratoshark is currently limited to capture on Linux (we're hoping to expand to macOS and Windows in the future) and the UI runs on all three platforms. There's an enhancement request[1] to add Procmon file support but I haven't had a chance to investigate what that might require. [1]https://gitlab.com/wireshark/wireshark/-/issues/20317 https://gitlab.com/wireshark/wireshark/-/issues/20317
  - knowitnone 2y ago
    yet there is a windows installer?
    - danparsonson 2y ago
      Capture on Linux, analyse on Windows
      - RachelF 2y ago
        OK, that makes more sense.
idiotsecant 2y ago
I just want to thank you for wireshark. I use it almost every day when I'm troubleshooting why this or that piece of industrial controls hardware springs a leak in its bit plumbing. You have the rare distinction of developing a tool that will probably outlive us all. So, thanks!
zxvkhkxvdvbdxz 2y ago
Here's a interview with Gerald about Stratoshark (9 min) https://www.youtube.com/watch?v=VjsmfuIqo8Q https://www.youtube.com/watch?v=VjsmfuIqo8Q
jcul 2y ago
Wow, I've been a wireshark user for many years, this is really exciting.
deleted 2y ago
[deleted]
beaugunderson 2y ago
We have a Python application that we develop inside Docker on macOS using the `python:3.11-slim-bullseye` image that it would be great to generate scap files from for viewing with Stratoshark. I tried installing sysdig in that image but ran into kernel module errors when trying to run it. Should we expect that to work? Am I missing an easier method?
- geraldcombs 2y ago
  You might try passing `--modern-bpf` to sysdig. It has traditionally captured syscalls using a kernel module, and it sounds like that's where your errors are coming from. Newer versions have added eBPF support, which doesn't require a kmod but you have to pass in the `--modern-bpf` flag.
  - beaugunderson 2y ago
    Absolutely nailed it, that worked! Thanks so much for the pointer.

321 points by geraldcombs 2y ago

napolux 2y ago

having used wireshark since i was a kid... this looks really promising

Chihuahua0633 2y ago
Do you have any wildly good Wireshark resources to reference -- I know I'm barely scratching the surface.
- 12bits 2y ago
  https://www.youtube.com/@ChrisGreer https://www.youtube.com/@ChrisGreer if you are into video format.
  - geraldcombs 2y ago
    Chris is definitely a good resource! We (the Wireshark Foundation) also have SharkFest session recordings up at https://www.youtube.com/@WireSharkFest https://www.youtube.com/@WireSharkFest

n1g3ld0uglas2 2y ago

Being able to use Wireshark in Kubernetes is super exciting. I can't wait to get started!

mdaniel 2y ago

clickable link: https://stratoshark.org https://stratoshark.org I found its man page in the repo which I found insightful https://gitlab.com/wireshark/wireshark/-/blob/ssv0.9.0/doc/man_pages/stratoshark.adoc?ref_type=tags https://gitlab.com/wireshark/wireshark/-/blob/ssv0.9.0/doc/m... and don't overlook this neato thing: https://gitlab.com/wireshark/wireshark/-/blob/ssv0.9.0/doc/man_pages/sshdig.adoc?ref_type=tags https://gitlab.com/wireshark/wireshark/-/blob/ssv0.9.0/doc/m...

westurner 2y ago

Re: custom fields in pcap traces and retis https://github.com/retis-org/retis https://github.com/retis-org/retis

freedomben 2y ago

Long, long time user of Wireshark and I instantly recognize your name. Thank you for all the great work over the years :-) Looks really awesome! I didn't see Linux installation instructions so clicked on the link to the source code, but it links to the Wireshark source[1]. Is Stratoshark part of the same repo as Wireshark? Is Linux supported by Stratoshark? [1]: https://gitlab.com/wireshark/wireshark https://gitlab.com/wireshark/wireshark

geraldcombs 2y ago
Thanks! It's part of the same code base (and therefore open source), and Linux is definitely supported. It adds libscap and libsinsp as dependencies, and you can find basic build instructions at https://gitlab.com/wireshark/wireshark/-/blob/master/doc/stratoshark-quick-start.adoc https://gitlab.com/wireshark/wireshark/-/blob/master/doc/str....

imcritic 2y ago

Can this program do more than just observe and trace what happens? Can one use it to set up some rule to suppress some of the syscalls sent to a specific process? Or alter them by some logic on the go?

geraldcombs 2y ago
It's currently only passive, but that'd be an interesting feature. In order for that to happen we'd have to add that functionality to https://github.com/falcosecurity/libs/ https://github.com/falcosecurity/libs/ along with the necessary plumbing in the UI.

pimlottc 2y ago

The first section on the homepage doesn’t give me a good sense of what the application does. The references to Wireshark suggest it has something to do with network traffic but that doesn’t seem to be the case. It also talks about cloud but nothing seems to be cloud-specific?

gertrunde 2y ago
The blog article is a bit more descriptive : https://sysdig.com/blog/stratoshark-extending-wiresharks-legacy-into-the-cloud/ https://sysdig.com/blog/stratoshark-extending-wiresharks-leg... tl;dr version: system calls, but in the wireshark ui. (I've probably oversimplified that!)
- vasco 2y ago
  Thanks for your work! Been using Wireshark for many years after it was used for a network course in university. Why do you focus on "what happens in your cloud" when we talk about system calls? It'd seem it's useful for any machine, is it just bad marketing copy or am I missing something?
  - geraldcombs 2y ago
    You're welcome! It was initially developed as part of my day job at Sysdig, a cloud security company. The initial feature set and use cases focus on getting .scaps (system call and log captures) from cloud environments, but you're entirely correct -- this has much more general applications including troubleshooting and education just like Wireshark does on the networking side.
    - vasco 2y ago
      Thanks for confirming and thanks again for the amazing work.
    - kristopolous 2y ago
      Hey Gerald, It's Chris from the CACE days. Nice to hear from you. I see this is part of wireshark proper, I'll look into getting this into debian

observationist 2y ago

The OP URL has been flagged as grayware by Palo Alto and is thus inaccessible to a large number of people, possibly indicating typosquatting, or being miscategorized? https://wiki.wireshark.org/Stratoshark https://wiki.wireshark.org/Stratoshark is a good link for those who can't reach the stratoshark URL directly. The OP link may get recategorized and become accessible in the meantime.

geraldcombs 2y ago
Well, crap. The domain and site are still fairly new, so maybe that's the issue? Is there anyone here from Palo Alto that can take a look?
- observationist 2y ago
  Going through their URL filtering site and requesting a recategorization is the best option for now, unless someone from the company sees it. https://urlfiltering.paloaltonetworks.com/ https://urlfiltering.paloaltonetworks.com/
  - geraldcombs 2y ago
    Done. We've been upgraded from medium-risk "grayware" to low-risk "generally do not contain content that is useful to the end user" which is technically better, I suppose. Update: We're now Low-Risk / Computer-and-Internet-Info.

clbrmbr 2y ago

Wireshark is to tcpdump as stratoshark is to strace. Did I get the analogy right?

geraldcombs 2y ago
Pretty much. It's part of the same ecosystem as Sysdig OSS[1], which works much like strace. It uses the same underlying libraries as sysdig and Falco, and you can move capture files between them. It'd be interesting to see if we can integrate more fully with strace as well, but that might require updating strace itself. [1]https://github.com/draios/sysdig https://github.com/draios/sysdig
- IshKebab 2y ago
  Why is it talking about clouds and stratospheres then? strace is pretty far from "the cloud" isn't it?
  - uhei 2y ago
    With the falco plugins [1] a broad range of "cloud native" services can be captured in Stratoshark. At the moment we have AWS cloudtrail and GCP Audit included in the macOS and Win installers. [1] https://github.com/falcosecurity/plugins?tab=readme-ov-file#registered-plugins https://github.com/falcosecurity/plugins?tab=readme-ov-file#...

brutopia 2y ago

How does it trace syscalls on macos? Do you need to disable SIP?

deleted 2y ago
[deleted]
geraldcombs 2y ago
Right now the UI runs on Windows, macOS, and Linux but you can only capture system calls on Linux via Falco libs[1]. Expanding local capture to include macOS and Windows is definitely something we'd love to do! [1]https://github.com/falcosecurity/libs https://github.com/falcosecurity/libs
- nikisweeting 2y ago
  Awesome! Thanks for your work on this and everything else. Once you add capture on macOS with something like dtrace, could you concievably capture a system call inside Docker on macOS and watch it trickle down through the linux hypervisor and then to the host darwin kernel and back? How does it conceptually track the handoff of system calls between hypervisors/VMs/containers/etc?
  - geraldcombs 2y ago
    In this case you would presumably have a capture file that contained syscall events at both the macOS boundary and at the Linux VM boundary. At the present time it would be like capturing traffic on either side of a firewall and loading it into Wireshark (which is something people do!) You'd have to correlate the events visually/manually but adding an automatic correlation feature is well within the realm of possibility.
    - nikisweeting 2y ago
      Yeah I was imagining something like the TLS session tracing feature in Wireshark that lets you see all the packets related to a single TLS connection. I currently struggle debugging opaque containers and VMs that run lots of concurrent async jobs, having some kind of tool to trace and group syscalls through the stack would be amazing.

tarasglek 2y ago

It is not clear what the architecture for system-call capture is. Is it ptrace, ebpf or some custom thing or some combo? What is the overhead of running this? The tool looks really cool, hopefully it moves ui state of art beyond windows xperf

geraldcombs 2y ago
It uses Falco libs[1] underneath, which supports capture using eBPF or a kmod. I work with the Falco libs team and they go to great lengths to minimize overhead. [1]https://github.com/falcosecurity/libs/ https://github.com/falcosecurity/libs/

zokier 2y ago

Does sysdig (and stratoshark by extension) still require custom out-of-tree kernel module to function?

uhei 2y ago
No, with the parameter '--modern-bpf' you can use eBPF. So, no kmod required any more.

thesuitonym 2y ago

Would I be right in assuming this is like Sysinternals procmon but with a better interface and for Linux?

geraldcombs 2y ago
The tools are similar in many ways, but Stratoshark shares Wireshark's dissection, filtering, and UI code, which provides a more low-level details and a free-form filtering language. Stratoshark is currently limited to capture on Linux (we're hoping to expand to macOS and Windows in the future) and the UI runs on all three platforms. There's an enhancement request[1] to add Procmon file support but I haven't had a chance to investigate what that might require. [1]https://gitlab.com/wireshark/wireshark/-/issues/20317 https://gitlab.com/wireshark/wireshark/-/issues/20317
- knowitnone 2y ago
  yet there is a windows installer?
  - danparsonson 2y ago
    Capture on Linux, analyse on Windows
    - RachelF 2y ago
      OK, that makes more sense.

idiotsecant 2y ago

I just want to thank you for wireshark. I use it almost every day when I'm troubleshooting why this or that piece of industrial controls hardware springs a leak in its bit plumbing. You have the rare distinction of developing a tool that will probably outlive us all. So, thanks!

zxvkhkxvdvbdxz 2y ago

Here's a interview with Gerald about Stratoshark (9 min) https://www.youtube.com/watch?v=VjsmfuIqo8Q https://www.youtube.com/watch?v=VjsmfuIqo8Q

jcul 2y ago

Wow, I've been a wireshark user for many years, this is really exciting.

deleted 2y ago

[deleted]

beaugunderson 2y ago

We have a Python application that we develop inside Docker on macOS using the `python:3.11-slim-bullseye` image that it would be great to generate scap files from for viewing with Stratoshark. I tried installing sysdig in that image but ran into kernel module errors when trying to run it. Should we expect that to work? Am I missing an easier method?

geraldcombs 2y ago
You might try passing `--modern-bpf` to sysdig. It has traditionally captured syscalls using a kernel module, and it sounds like that's where your errors are coming from. Newer versions have added eBPF support, which doesn't require a kmod but you have to pass in the `--modern-bpf` flag.
- beaugunderson 2y ago
  Absolutely nailed it, that worked! Thanks so much for the pointer.