#pcap #packet #network

suricata-ipc

Library for sending packets to suricata and receiving output

27 releases (9 breaking)

new 0.10.11 Sep 23, 2020
0.9.7 Sep 14, 2020
0.3.0 Jul 2, 2020

#215 in Network programming

Download history 8/week @ 2020-06-04 2/week @ 2020-06-11 42/week @ 2020-07-02 4/week @ 2020-07-09 7/week @ 2020-07-16 8/week @ 2020-07-23 96/week @ 2020-07-30 51/week @ 2020-08-06 57/week @ 2020-08-13 22/week @ 2020-08-20 100/week @ 2020-08-27 110/week @ 2020-09-03 237/week @ 2020-09-10 140/week @ 2020-09-17

298 downloads per month

MIT/Apache

89KB
2K SLoC

suricata-ipc

Library to enable packet sharing with suricata, and reading alerts from an eve socket. Alerts read can then use an intel cache to determine additional metadata about them.

use suricata_ipc::prelude::*;

#[tokio::main]
async fn main() {
    let rules = Rules::from_path("my.rules").expect("Failed to parse rules");
    let config = Config::default();
    let rules = Rules::from_path(resources.join("test.rules")).expect("Could not parse rules");
    let cache: IntelCache<Rule> = rules.into();
    cache.materialize_rules(config.rule_path.clone()).expect("Failed to materialize rules");

    let mut ids = Ids::new(config).await.expect("Failed to create ids");
    let ids_alerts = ids.take_alerts().expect("No alerts");

    send_packets(&mut ids).await.expect("Failed to send packets");

    let alerts: Result<Vec<_>, Error> = ids_alerts.try_collect().await;
    let alerts: Result<Vec<_>, Error> = alerts.expect("Failed to receive alerts")
        .into_iter().flat_map(|v| v).collect();
    let alerts = alerts.expect("Failed to parse alerts");

    for eve in alerts {
        println!("Eve={:?}", eve);
        if let Some(intel) = cache.observed(eve) {
            if let Observed::Alert { rule, message: _ } = intel {
                println!("Rule={:?}", rule);
            }
        }
    }
}

Develop With Docker

Install lefthook. You can then run

lefthook run develop

Dependencies

~6.5–9MB
~185K SLoC