Bring the Power of Wireshark To Syscalls and Logs With Stratoshark

## Overview

Gerald Combs, creator of Wireshark and co-creator of Stratoshark, presented how Wireshark's proven dissection engine—which supports 3,000 protocols and 265,000 fields—can be applied to system calls and log messages. Wireshark's core strength is its ability to provide granular detail about every field in data, enabling users to build complex filters, colorize events, and graph trends. Combs drew a parallel between system calls and network packets: both form a boundary layer characterizing system behavior and revealing security or performance issues.

## Key Topics

The technical foundation rests on two libraries: **libscap** (library for system capture), which hooks into the Linux kernel via kernel module or eBPF probe to capture syscalls, and **libs** (library for system inspection), which enriches that data by mapping file descriptors to file paths, user IDs to usernames, and similar contextual information. Two main tools consume these libraries: **Cydig**, a command-line utility producing a "fire hose" of syscall output, and **Falco**, a host-based IDS that continuously monitors syscalls against rules.

**Stratoshark** is Combs's implementation: it ports Wireshark's dissection engine and UI to syscalls and logs. The tool mirrors Wireshark's layout with event-based fields (event name, process ID, username, etc.), supports Lua post-dissectors, enables filtering and stream-following, and displays rich detail for each event. Stratoshark ships with plugins for cloud audit sources—AWS CloudTrail, Google Cloud audit logs, Kubernetes audit logs—allowing forensic analysis of cloud activity.

## Technical Details

In a live demo, Combs captured remote Linux syscalls via SSH, filtered for specific processes (bash, curl), and investigated a compromised script attempting to exfiltrate `/etc/passwd`. He demonstrated filtering on file descriptor type and name, following pipe streams, and pivoting investigation by process ID. Stratoshark integrates Wireshark's ELF dissector, revealing executable format metadata within syscall captures—demonstrating Wireshark's ability to dissect non-protocol data (JPEG, PNG, MP3). A second demo showed loading an AWS CloudTrail JSON log and inspecting failed S3 bucket operations via pretty-printed JSON view.

The I/O buffer size is configurable (default 80 bytes, configurable via settings like the 512-byte snapshot limit shown). Remote capture uses SSH to run cydig under sudo, necessary for enriched privilege and process information from `/proc`. The scap file format is based on pcapng, enabling potential future mixing of syscalls, logs, and network packets.

## Roadmap and Status

Stratoshark is available as installers for Windows and macOS; Linux requires building from source. Combs noted that traditional Linux distribution packages are not yet available. The tool captures syscalls locally on Linux and remotely via SSH from any platform. Future capabilities under consideration include Windows syscall capture via Event Tracing for Windows (ETW), macOS syscall support (framework exists but unfamiliar to Combs), and integration of strace and Process Monitor file formats.

Stratoshark and Falco are separate tools sharing libscap and libs; Falco is lightweight for continuous monitoring, Stratoshark is feature-rich for forensic investigation. Version 0.9.x releases are ongoing, with version 1.0 targeted for late summer or early fall, synchronized with the next major Wireshark release. Stratoshark and Falco share similar filtering languages (not identical to Wireshark display filters), and an experimental feature converts Wireshark display filters to Falco rules.