#pcap #packet #network

suricata-ipc

Library for sending packets to suricata and receiving output

39 releases (14 breaking)

new 0.15.1 Nov 20, 2020
0.14.3 Nov 7, 2020
0.3.0 Jul 2, 2020

#199 in Network programming

Download history 126/week @ 2020-08-02 37/week @ 2020-08-09 57/week @ 2020-08-16 37/week @ 2020-08-23 93/week @ 2020-08-30 171/week @ 2020-09-06 212/week @ 2020-09-13 158/week @ 2020-09-20 253/week @ 2020-09-27 86/week @ 2020-10-04 87/week @ 2020-10-11 127/week @ 2020-10-18 139/week @ 2020-10-25 138/week @ 2020-11-01 125/week @ 2020-11-08 123/week @ 2020-11-15

570 downloads per month

MIT/Apache

135KB
3.5K SLoC

Rust 2.5K SLoC // 0.0% comments C 550 SLoC // 0.1% comments Shell 172 SLoC // 0.0% comments

suricata-ipc

Library to enable packet sharing with suricata, and reading alerts from an eve socket. Alerts read can then use an intel cache to determine additional metadata about them.

use suricata_ipc::prelude::*;

#[tokio::main]
async fn main() {
    let rules = Rules::from_path("my.rules").expect("Failed to parse rules");
    let config = Config::default();
    let rules = Rules::from_path(resources.join("test.rules")).expect("Could not parse rules");
    let cache: IntelCache<Rule> = rules.into();
    cache.materialize_rules(config.rule_path.clone()).expect("Failed to materialize rules");

    let mut ids = Ids::new(config).await.expect("Failed to create ids");
    let ids_alerts = ids.take_alerts().expect("No alerts");

    send_packets(&mut ids).await.expect("Failed to send packets");

    let alerts: Result<Vec<_>, Error> = ids_alerts.try_collect().await;
    let alerts: Result<Vec<_>, Error> = alerts.expect("Failed to receive alerts")
        .into_iter().flat_map(|v| v).collect();
    let alerts = alerts.expect("Failed to parse alerts");

    for eve in alerts {
        println!("Eve={:?}", eve);
        if let Some(intel) = cache.observed(eve) {
            if let Observed::Alert { rule, message: _ } = intel {
                println!("Rule={:?}", rule);
            }
        }
    }
}

Develop With Docker

Install lefthook. You can then run

lefthook run develop

Building IPC Plugin

Refer to IPC Plugin Readme for instructions. You will need the IPC plugin to use suricata-ipc.

Dependencies

~7–10MB
~206K SLoC