Tshark OpenSearch

analysis

Dockerised stack that indexes tshark NDJSON into OpenSearch + Dashboards, with optional simple-NIDS live capture.

make deploy brings up OpenSearch + Dashboards + Logstash with TLS, auth, and an ISM retention policy. Upload PCAPs via TCP, file input, or live capture through simple-NIDS, then search and dashboard packet data in OpenSearch.

A Docker Compose stack, OpenSearch, OpenSearch Dashboards, Logstash, and an optional simple-NIDS bridge, that ingests tshark -T ek NDJSON via TCP or file input (or live capture), indexes packet data with a custom tshark→OpenSearch mapping, applies TLS and auto-generated admin credentials, and manages retention through an ISM policy. Deploys with a single make deploy.

What it does

• Ingests tshark -T ek (Elastic-bulk NDJSON) over TCP (port 17570) or file input.
• Indexes into OpenSearch with a custom mapping template (frame/eth/ip/udp/tcp/dhcp by default, extensible).
• Ships an OpenSearch Dashboards tenant with pre-built Main and Discover dashboards.
• Auto-generates TLS certificates and an admin password on first deploy (saved to .env).
• ISM retention policy auto-deletes packets-* indices after a configurable period (default 30 days).
• Optional simple-NIDS Go service: live packet capture and port-scan detection with two modes, nids (suspicious traffic only) or capture (full traffic).
• Bridge container converts NIDS pcaps with tshark and feeds them into Logstash automatically.
• Upload PCAPs from the host with make upload (TCP) or make upload-files (preserves filenames).

Best for

• Investigators with existing OpenSearch tooling.
• Detection teams enriching telemetry with packet context.
• Lab operators wanting a self-contained, TLS-protected packet-search stack.

Protocols: IP, SS7, Diameter, GTP, SIP

Inputs: PCAP / PCAPNG, tshark NDJSON (-T ek), Live capture (simple-NIDS)

Outputs: OpenSearch indices (packets-*), OpenSearch Dashboards visualisations, NIDS pcap evidence files