Sharker: where Wireshark ends, we begin

Sharker is a powerful and extensible tool for extracting valuable data from PCAP files or from live interfaces. It leverages the power of tshark to efficiently parse network captures and applies a flexible filtering system to pinpoint and extract juicy information.

Key Features

• Extensible Filtering: Create Python-based filters to extract any data from network packets.
• Powerful Filtering Engine: Selectively enable or disable filters and filter categories to fine-tune and speed up your analysis.
• Multiple Input Sources: Analyze .pcap files, directories of captures, or even live network traffic from an interface.
• Flexible Output: Save results to organized text files, print to the console, or both.

Requirements

• tshark: The command-line companion to Wireshark is essential. You can typically install it through your system's package manager (e.g., apt-get install tshark, brew install wireshark).
• Python 3
• Python libraries: The required libraries are listed in requirements.txt and can be installed with pip/pipx.

Installation

You can install Sharker using pipx (recommended) or a standard pip and venv environment.

Using pipx (Recommended)

# Install from this repository
pipx install git+https://github.com/synacktiv/sharker.git

# Verify the installation
sharker -h

Using pip and venv

# Clone the repository
git clone https://github.com/synacktiv/sharker.git
cd sharker

# Create and activate a virtual environment
python3 -m venv venv
source venv/bin/activate

# Install Sharker
pip install .

# Verify the installation
sharker -h

Usage

The basic syntax for Sharker is:

sharker [OPTIONS] [PCAP_FILE(s)]

Common Options

Main options

Filtering options

Example Usage

1. Analyze a single PCAP and save the results:

sharker my_capture.pcap

This will run all filters except those in the heavy category and save the output to the sharker_out/ directory. Filters in the creds category will also be printed to stdout.

2. Apply all filters and try to go as fast as possible:

sharker -A -F my_captures.pcap

This will apply all filters and output everything to files, no results will be printed on the console.

3. Analyze a directory of PCAPs, focusing on credentials:

sharker -d /path/to/pcaps -c creds

This command processes all PCAP files in the specified directory, but only runs the filters in the creds category.

4. Capture live traffic and print HTTP-related information to the console:

sudo sharker -i eth0 -c http -m console

This will capture traffic from the eth0 interface, run only the http category filters, and print all results directly to the terminal.

5. List all available filters:

sharker -L

Help output

$ sharker -h
Usage: sharker [OPTIONS] [PCAP[ PCAP[ ...]]

  Sharker: A reasonably fast network protocol analysis tool with extensible
  filters.