Stratoshark

About

Stratoshark turns system call and log activity into something you can filter, color-code, graph, and save, instead of scrolling through raw trace output. You can capture once, keep the file, and come back to it or share it with the same filters and views. This makes debugging structured and repeatable, whether it's a one-off issue on a workstation or a recurring problem in production. It works on a single Linux machine, in containers, or across the cloud.

Stratoshark is a sibling application to Wireshark. It shares the same dissection and filtering engine and much of the same user interface, so existing Wireshark users will find the filter language and workflow familiar. It supports the same file format as Falco and the Sysdig CLI, letting you move between those tools without conversion. It is built on the Wireshark interface and made possible with major support from Sysdig.

Stratoshark is free and open source. The source is on GitLab, the community is on Discord, and contributions are welcome. The Wireshark Foundation backs the project.