Project

General

Profile

Actions

Feature #5499

open

PCAP-over-IP client

Added by Erik Hjelmvik over 1 year ago. Updated 5 months ago.

Status:
New
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

Implement a PCAP-over-IP client, so that packets can be read from a TCP socket as an alternative to reading a pcap file or sniffing an interface.

PCAP-over-IP can be used to live-stream captured packets from a remote sniffer to Suricata, but the most useful use-case is probably in order to read decrypted HTTPS traffic from a TLS proxy without having to replay it to a dummy network interface. There are several downsides of replaying packets to an interface, such as requiring root privs and risk of packet loss, so reading them from a TCP socket instead is preferable.

It would be nice if Suricata would support the same TCP socket interface syntax as Wireshark/tshark.
https://wiki.wireshark.org/CaptureSetup/Pipes.md#tcp-socket

suricata -i TCP@192.168.1.2:57012

Or if the TCP socket could be specified with -r:

suricata -r TCP@192.168.1.2:57012

Another option would be to add a custom option specifically for PCAP-over-IP:

suricata --pcapoveripconnect 192.168.1.2:57012

Actions #1

Updated by Brandon Murphy 6 months ago

Actions #2

Updated by Victor Julien 5 months ago

  • Assignee changed from OISF Dev to Community Ticket

While a nice idea, I don't see us working on this anytime soon. So could be a nice project for someone looking to contribute.

Actions

Also available in: Atom PDF