Bring the Power of Wireshark To Syscalls and Logs With Stratoshark
summary
Stratoshark brings Wireshark’s dissection engine to system calls and logs, built on libscap/libs and shipping plugins for CloudTrail and GCP audit logs; captures come via eBPF or kernel module locally or over SSH, with IO snapshots adjustable (demo uses 512 bytes). The UI lets investigators follow FD stream and dissect ELF data; a live demo shows detecting curl exfiltrating /etc/passwd via pipe. Windows and macOS installers exist, Linux requires building; 0.9.3 lands soon.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:37Wireshark overview
- 6:53Libpcap ecosystem
- 8:38System calls as data
- 12:49Stratoshark architecture
- 14:39Live demo: system calls
- 26:24AWS CloudTrail logs
- 28:50Stratoshark roadmap
- 32:43Resources
- 35:13Q&A
related talks
36m50 Shades of System Calls
05mForensics With Falco
43mWTF, My Container Just Spawned a Shell
32mListen to your Engine
45mWhat is new in KernelShark two
46mThe Next Log4jshell?! Preparing for CVEs with eBPF!
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
23mSecuring Your Software Delivery Chain with Process Auditing