[{"data":1,"prerenderedAt":353},["ShallowReactive",2],{"project-42793777":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":40,"post_text":42,"what":43,"said":75,"maker_in_thread":177,"shape":188,"grid":192,"attempts":315,"same_week":316,"maker_shows":34,"maker_hidden":345,"reader_version":346,"card":347},"42793777","Stratoshark","A sibling application to Wireshark","title","Show HN: Stratoshark, a sibling application to Wireshark","https:\u002F\u002Fstratoshark.org\u002F","stratoshark.org","geraldcombs",1737559532,2025,321,50,155,3837,5,"legend","dev_tools","system call tracing","desktop_app",[21,24,25,26,27],"strace alternative","wireshark","syscall capture","falco","loved",0.307,{"positive":31,"neutral":32,"mixed":33,"critical":34},11,19,0,1,31,{"idea":37,"docs":38,"performance":39},{"positive":34,"critical":33},{"positive":34,"critical":34},{"positive":34,"critical":33},[18,33,41,41,33,41,33,41,34,41,41,18,18,33,33,41,41,33,41,41,18,18,33,41,18,41,41,18,41,33,18,41,33,41,33,18,33,18,33,33],3,"Hi all, I'm excited to announce Stratoshark, a sibling application to Wireshark that lets you capture and analyze process activity (system calls) and log messages in the same way that Wireshark lets you capture and analyze network packets. If you would like to try it out you can download installers for Windows and macOS and source code for all platforms at https:\u002F\u002Fstratoshark.org.\n\nAMA: I'm the goofball whose name is at the top of the \"About\" box in both applications, and I'll be happy to answer any questions you might have.",{"problem":44,"audience":53,"pricing":53,"motivation":54,"time_to_build":53,"stack":58,"openness":72,"stage":73,"team_size":74},{"value":45,"source":46,"evidence":47},"Inspecting process system calls and log messages with a Wireshark-style interface","maker",[48,50],{"id":49},"post",{"id":51,"by":11,"text":52},"42796343","You're welcome! It was initially developed as part of my day job at Sysdig, a cloud security company. The initial feature set and use cases focus on getting .scaps (system call…",null,{"value":55,"source":46,"evidence":56},"Extend Wireshark's approach to system call analysis, initially for cloud environments",[57],{"id":51,"by":11,"text":52},[59,65],{"value":60,"source":46,"evidence":61},"Wireshark",[62],{"id":63,"by":11,"text":64},"42795743","Thanks! It's part of the same code base (and therefore open source), and Linux is definitely supported. It adds libscap and libsinsp as dependencies, and you can find basic build…",{"value":66,"source":46,"evidence":67},"Falco libs (libscap, libsinsp)",[68,69],{"id":63,"by":11,"text":64},{"id":70,"by":11,"text":71},"42797151","It uses Falco libs[1] underneath, which supports capture using eBPF or a kmod. I work with the Falco libs team and they go to great lengths to minimize overhead.…","open_source","launched","unknown",{"praise":76,"objections":100,"requests":124,"questions":136,"alternatives":155},[77,93],{"value":78,"source":79,"evidence":80},"Long-time Wireshark users welcome the sibling tool","commenter",[81,85,89],{"id":82,"by":83,"text":84},"42795581","freedomben","Long, long time user of Wireshark and I instantly recognize your name. Thank you for all the great work over the years :-) Looks really awesome! I didn't see Linux installation…",{"id":86,"by":87,"text":88},"42802537","jcul","Wow, I've been a wireshark user for many years, this is really exciting.",{"id":90,"by":91,"text":92},"42793831","napolux","having used wireshark since i was a kid... this looks really promising",{"value":94,"source":79,"evidence":95},"Useful for troubleshooting and education",[96],{"id":97,"by":98,"text":99},"42796125","vasco","Thanks for your work! Been using Wireshark for many years after it was used for a network course in university. Why do you focus on \"what happens in your cloud\" when we talk…",[101,108,117],{"value":102,"source":79,"evidence":103},"Homepage did not clearly explain what the app does",[104],{"id":105,"by":106,"text":107},"42795918","pimlottc","The first section on the homepage doesn’t give me a good sense of what the application does. The references to Wireshark suggest it has something to do with network traffic but…",{"value":109,"source":46,"evidence":110},"Capture limited to Linux",[111,114],{"id":112,"by":11,"text":113},"42797709","The tools are similar in many ways, but Stratoshark shares Wireshark's dissection, filtering, and UI code, which provides a more low-level details and a free-form filtering…",{"id":115,"by":11,"text":116},"42796985","Right now the UI runs on Windows, macOS, and Linux but you can only capture system calls on Linux via Falco libs[1]. Expanding local capture to include macOS and Windows is…",{"value":118,"source":79,"evidence":119},"Flagged as grayware by Palo Alto filtering",[120],{"id":121,"by":122,"text":123},"42796181","observationist","The OP URL has been flagged as grayware by Palo Alto and is thus inaccessible to a large number of people, possibly indicating typosquatting, or being miscategorized?…",[125,129],{"value":126,"source":79,"evidence":127},"Add macOS and Windows capture",[128],{"id":115,"by":11,"text":116},{"value":130,"source":79,"evidence":131},"Support for active rule-based syscall modification",[132],{"id":133,"by":134,"text":135},"42795916","imcritic","Can this program do more than just observe and trace what happens? Can one use it to set up some rule to suppress some of the syscalls sent to a specific process? Or alter them…",[137,141,148],{"value":138,"source":79,"evidence":139},"Is Linux supported and is this in the Wireshark repo",[140],{"id":82,"by":83,"text":84},{"value":142,"source":79,"evidence":143},"How syscalls are captured on macOS",[144],{"id":145,"by":146,"text":147},"42796786","brutopia","How does it trace syscalls on macos? Do you need to disable SIP?",{"value":149,"source":79,"evidence":150},"Whether sysdig still needs a kernel module",[151],{"id":152,"by":153,"text":154},"42797187","zokier","Does sysdig (and stratoshark by extension) still require custom out-of-tree kernel module to function?",[156,163,170],{"value":157,"source":79,"evidence":158},"strace",[159],{"id":160,"by":161,"text":162},"42796382","clbrmbr","Wireshark is to tcpdump as stratoshark is to strace. Did I get the analogy right?",{"value":164,"source":79,"evidence":165},"DTrace",[166],{"id":167,"by":168,"text":169},"42796371","sesm","So, DTrace with Wireshark UI?",{"value":171,"source":79,"evidence":172},"Sysinternals procmon",[173],{"id":174,"by":175,"text":176},"42797313","thesuitonym","Would I be right in assuming this is like Sysinternals procmon but with a better interface and for Linux?",{"comments":178,"answered":179,"key":180},15,12,[181,182,185],{"id":63,"text":64},{"id":183,"text":184},"42796306","Well, crap. The domain and site are still fairly new, so maybe that's the issue? Is there anyone here from Palo Alto that can take a look?",{"id":186,"text":187},"42797774","Done. We've been upgraded from medium-risk \"grayware\" to low-risk \"generally do not contain content that is useful to the end user\" which is technically better, I suppose.…",{"commenters":35,"max_depth":189,"maker_replies":178,"first_comment_mins":190,"lifespan_hours":191},6,4,173,[193,195,197,199,201,203,204,207,209,212,215,217,221,222,223,225,228,230,232,233,235,236,237,240,243,247,251,255,257,261,263,265,267,269,273,278,279,281,282,286,288,289,292,294,297,300,304,306,310,313],[82,33,18,194,83,33],"maker\u002Fpositive\u002Fnone",[63,33,33,196,11,34],"maker\u002Fneutral\u002Fdocs",[121,34,41,198,122,33],"project\u002Fneutral\u002Fnone",[183,34,33,200,11,34],"maker\u002Fneutral\u002Fnone",[202,34,41,200,122,33],"42797108",[186,34,33,200,11,34],[160,205,41,206,161,33],2,"project\u002Fneutral\u002Fidea",[208,205,33,206,11,34],"42796505",[210,205,41,206,211,33],"42797498","IshKebab",[213,205,41,206,214,33],"42797647","uhei",[105,41,34,216,106,33],"project\u002Fcritical\u002Fdocs",[218,41,41,219,220,33],"42795959","project\u002Fneutral\u002Fdocs","gertrunde",[97,41,41,206,98,33],[51,41,33,206,11,34],[224,41,18,194,98,33],"42796431",[226,41,18,194,227,33],"42796728","kristopolous",[229,41,33,200,11,34],"42809052",[231,41,33,219,11,34],"42796072",[167,41,41,206,168,33],[234,41,33,206,11,34],"42796570",[174,190,41,206,175,33],[112,190,33,198,11,34],[238,190,41,198,239,33],"42798157","knowitnone",[241,190,41,198,242,33],"42798511","danparsonson",[244,190,33,245,246,33],"42799984","commenter\u002Fneutral\u002Fnone","RachelF",[248,18,18,249,250,33],"42793884","project\u002Fpositive\u002Fdocs","mdaniel",[252,189,18,253,254,33],"42797046","project\u002Fpositive\u002Fperformance","tarasglek",[70,189,33,256,11,34],"project\u002Fneutral\u002Fperformance",[258,259,41,198,260,33],"42818878",7,"beaugunderson",[262,259,33,198,11,34],"42823405",[264,259,18,194,260,33],"42823512",[152,266,41,198,153,33],8,[268,266,41,198,214,33],"42797604",[270,271,18,194,272,33],"42800110",9,"idiotsecant",[274,275,18,276,277,33],"42793872",10,"project\u002Fpositive\u002Fnone","n1g3ld0uglas2",[133,31,41,206,134,33],[280,31,33,206,11,34],"42796065",[86,179,18,276,87,33],[283,284,41,219,285,33],"42800519",13,"zxvkhkxvdvbdxz",[145,287,41,198,146,33],14,[115,287,33,198,11,34],[290,287,41,206,291,33],"42797923","nikisweeting",[293,287,33,206,11,34],"42798314",[295,287,18,296,291,33],"42870708","project\u002Fpositive\u002Fidea",[298,287,41,206,299,33],"42807836","SmellyPotato22",[301,178,33,302,303,33],"42794178","other\u002Fneutral\u002Fnone","westurner",[90,305,18,276,91,33],16,[307,305,33,308,309,33],"42795536","other\u002Fneutral\u002Fdocs","Chihuahua0633",[311,305,33,308,312,33],"42795696","12bits",[314,305,33,308,11,34],"42805962",[],[317,322,326,331,335,340],{"id":318,"name":319,"points":320,"category":321},"42797260","Byran's open-source laptop",3237,"hardware",{"id":323,"name":324,"points":325,"category":20},"42749402","Interactive systemd",546,{"id":327,"name":328,"points":329,"category":330},"42796496","sms_llm",318,"creative",{"id":332,"name":333,"points":334,"category":20},"42738656","Mermaid Chart",230,{"id":336,"name":337,"points":338,"category":339},"42782295","Foqos",225,"productivity",{"id":341,"name":342,"points":343,"category":344},"42779330","TripOffice",222,"consumer_social",false,"v2",{"id":348,"name":5,"line":6,"ai":345,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":349,"top":18,"kw":350,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":351,"url":9,"mix":352,"praise":78,"objection":102,"sub":21},42793777,0.31,[21,24,25,26,27],"5033030313355003303355035335305303050500",[31,32,33,34],1794036668406]