Analyse a PCAP with Suricata¶

Replay an authorised capture through a pinned engine, configuration, and ruleset so another analyst can reproduce the result.

Prepare immutable evidence¶

Use only a capture you are authorised to possess and inspect. Malware-training captures can contain exploit traffic, credentials, or reconstructed files; use an isolated analysis VM with no automatic execution or preview.

mkdir -p "$HOME/suricata-pcap-analysis/output"
sha256sum <CAPTURE.pcap> > "$HOME/suricata-pcap-analysis/evidence.sha256"
sudo suricata --build-info > "$HOME/suricata-pcap-analysis/build-info.txt"
sha256sum /etc/suricata/overview.yaml \
  /var/lib/suricata/rules/suricata.rules \
  /etc/suricata/rules/local.rules \
  >> "$HOME/suricata-pcap-analysis/evidence.sha256"

Run the analysis¶

Keep offline output separate from live sensor logs:

sudo suricata \
  -r <CAPTURE.pcap> \
  -c /etc/suricata/overview.yaml \
  -l "$HOME/suricata-pcap-analysis/output"

Review engine completion, alerts, flows, and protocol events:

tail -n 30 "$HOME/suricata-pcap-analysis/output/suricata.log"
jq -r 'select(.event_type=="alert") | [.timestamp,.alert.signature_id,.alert.signature,.src_ip,.dest_ip] | @tsv' \
  "$HOME/suricata-pcap-analysis/output/eve.json"
jq -r 'select(.event_type=="flow") | [.flow_id,.community_id,.src_ip,.dest_ip,.proto] | @tsv' \
  "$HOME/suricata-pcap-analysis/output/eve.json" | head

Triage the results¶

For each finding, record:

SID, revision, classification, action, and ruleset source;
packet time, source, destination, protocol, and direction;
related events sharing flow_id or community_id;
the supporting packet or stream evidence; and
whether the result is confirmed, benign, false positive, or unresolved.

Do not treat an alert name as proof of compromise. Validate the packet context and explain limitations such as encrypted traffic, snap length, packet loss, asymmetric capture, disabled parsers, and missing files.

Compare configurations or rulesets¶

Run the same immutable PCAP into a second empty output directory, change only one variable, then compare SID counts. Explain differences using rule or configuration changes rather than alert totals alone.

Record the analysis¶

Retain the PCAP checksum, engine build info, configuration and rule checksums, command line, EVE output, analyst notes, and cleanup decision. Avoid copying captured payloads into reports unless necessary and authorised.

Completion criteriaThe PCAP result is tied to immutable evidence and can be reproduced from the recorded engine, configuration, rules, and command.