Photo by Cara Fuller on Unsplash
System Analysis with Stratoshark
Giving Chase
A computer uses various installed applications that often need to access external resources. For example, a web conferencing application needs access to the network and to sound devices. In contrast, a spreadsheet application needs to access hard drives, SSDs, or network drives. Of course, these applications do not inherently know on what mechanisms this access relies, which is where the operating system and system calls come into play.
The operating system knows the mechanisms for distinguishing between WiFi and Ethernet as well as between Bluetooth and wired headsets, removing the need for applications to take these differences into account themselves.To do so, the operating system offers a set of standardized functions, known as system calls (e.g., read(), write(), socket(), sendmsg()) that applications use to access these external devices or files. These functions play an important role when you need to investigate more closely how an application behaves in error situations or during security analyses – whether the application is accessing files or communicating on the network.
Thus far, this aspect has been a blind spot in an overall analysis. A new tool aims to provide visibility at the operating system level.
System Calls
Stratoshark [1] now offers the ability to analyze both these system calls and to log messages – much as Wireshark does for network packets. The focus here is on system calls. Stratoshark, a new open source tool by the Wireshark Foundation, is largely based on the Wireshark source code. It was developed under the auspices of Gerald Combs, Wireshark's inventor. His current employer, Sysdig, also provided the Falco and Sysdig capture tools required for activities and logging.
Stratoshark complements existing analysis tools with operating system
...
Buy this article as PDF
(incl. VAT)
Buy ADMIN Magazine
US / Canada
UK / Australia
Subscribe to our ADMIN Newsletters
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Most Popular
Support Our Work
ADMIN content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
