Feature #5499
openPCAP-over-IP client
Description
Implement a PCAP-over-IP client, so that packets can be read from a TCP socket as an alternative to reading a pcap file or sniffing an interface.
PCAP-over-IP can be used to live-stream captured packets from a remote sniffer to Suricata, but the most useful use-case is probably in order to read decrypted HTTPS traffic from a TLS proxy without having to replay it to a dummy network interface. There are several downsides of replaying packets to an interface, such as requiring root privs and risk of packet loss, so reading them from a TCP socket instead is preferable.
It would be nice if Suricata would support the same TCP socket interface syntax as Wireshark/tshark.
https://wiki.wireshark.org/CaptureSetup/Pipes.md#tcp-socket
suricata -i TCP@192.168.1.2:57012
Or if the TCP socket could be specified with -r:
suricata -r TCP@192.168.1.2:57012
Another option would be to add a custom option specifically for PCAP-over-IP:
suricata --pcapoveripconnect 192.168.1.2:57012
Files
Updated by Brandon Murphy over 1 year ago
+1 to this, cool idea for integrating with PolarProxy!
Referenced here: https://forum.suricata.io/t/forward-inspected-traffic-from-suricata-to-other-virtual-instance-polarproxy/3572/6
Updated by Victor Julien over 1 year ago
- Assignee changed from OISF Dev to Community Ticket
While a nice idea, I don't see us working on this anytime soon. So could be a nice project for someone looking to contribute.
Updated by Mahmoud Maatuq about 1 year ago
- Status changed from New to Assigned
- Assignee changed from Community Ticket to Mahmoud Maatuq
Updated by Hans Vermeer 10 months ago
- File pcapoverip.diff pcapoverip.diff added
In case this will be picked up again to merge into main, I've attached a dirty patch we applied to commit 31bed10ff6666cc122ebca7b2283fd2bd1b9ba90 to get this working.
Updated by Victor Julien 10 months ago
Any interest in cleaning it up and submitting it for inclusion?
Updated by Juliana Fajardini Reichow 7 months ago
Hi @Mahmoud Maatuq are you still working on this issue?
Updated by Mahmoud Maatuq 7 months ago
Hey @Juliana Fajardini Reichow, I almost forgot about this ticket, but yes I'm going to work on it, thanks for the remainder.
Updated by Mahmoud Maatuq 7 months ago
- Status changed from Assigned to In Progress