← Back to context

Comment by thesuitonym

1 month ago

Would I be right in assuming this is like Sysinternals procmon but with a better interface and for Linux?

4 comments

thesuitonym

Reply
geraldcombs  1 month ago

The tools are similar in many ways, but Stratoshark shares Wireshark's dissection, filtering, and UI code, which provides a more low-level details and a free-form filtering language. Stratoshark is currently limited to capture on Linux (we're hoping to expand to macOS and Windows in the future) and the UI runs on all three platforms. There's an enhancement request[1] to add Procmon file support but I haven't had a chance to investigate what that might require.

[1]https://gitlab.com/wireshark/wireshark/-/issues/20317