ZEEK(8)

💖 ZEEK(8) 💖

System Administration Utilities ✨ — okay bestie, this is the manual page for zeek(8), and we are gonna get you fluent in it, no cap.

---

🌸 NAME 🌸

zeek — your passive network traffic analyzer, and honestly? she's the main character of network security.

---

✨ SYNOPSIS ✨

zeek [options] [file ...]

---

🦋 DESCRIPTION 🦋

So like, Zeek is primarily a security monitor — she inspects all traffic on a link, in depth, looking for signs of suspicious activity. That's her whole vibe. But ngl, that's not all she does: Zeek supports a wide range of traffic analysis tasks even outside the security domain, including performance measurements and helping with trouble-shooting. Versatile queen 💅

Zeek comes with built-in functionality for a range of analysis and detection tasks, and here's the list, no skipping:

• detecting malware by interfacing to external registries
• reporting vulnerable versions of software seen on the network
• identifying popular web applications
• detecting SSH brute-forcing
• validating SSL certificate chains
• among others

⚠️ Real talk though: you must have the necessary permissions to access the files or interfaces specified. No permissions, no vibes. 😭

---

🎀 OPTIONS 🎀

• <file> — policy file, or read stdin. Your call, bestie.

---

• -a, --parse-only — exit immediately after parsing scripts. Like, parse and dip. 🫶
• -b, --bare-mode — don't load scripts from the base/ directory. Strip it down, minimal aesthetic.
• -d, --debug-policy — activate policy file debugging. 👑
• -e, --exec <zeek code> — augment loaded policies by given code.
• -f, --filter <filter> — tcpdump filter.
• -h, --help|-? — command line help. We love a helpful icon.
• -i, --iface <interface> — read from given interface.
• -p, --prefix <prefix> — add given prefix to policy file resolution.
• -r, --readfile <readfile> — read from given tcpdump file.
• -s, --rulefile <rulefile> — read rules from given file.
• -t, --tracefile <tracefile> — activate execution tracing.
• -w, --writefile <writefile> — write to given tcpdump file.
• -v, --version — print version and exit. Short and sweet, periodt.
• -x, --print-state <file.bst> — print contents of state file.
• -C, --no-checksums — okay so when this option is set, Zeek ignores invalid packet checksums and does process the packets. Furthermore, if this option is set Zeek also processes IP packets with a zero total length field, which is typically caused by TCP (TCP Segment Offloading) on the NIC. 😤
• -F, --force-dns — force DNS.
• -I, --print-id <ID name> — print out given ID.
• -N, --print-plugins — print available plugins and exit (-NN for verbose). Double the N, double the tea ☕
• -P, --prime-dns — prime DNS.
• -Q, --time — print execution time summary to stderr.
• -R, --replay <events.bst> — replay events. it's giving time travel 🕰️
• -S, --debug-rules — enable rule debugging.
• -T, --re-level <level> — set 'RE_level' for rules.
• -U, --status-file <file> — Record process status in file.
• -W, --watchdog — activate watchdog timer. she's watching 🐶
• -X, --zeekygen <cfgfile> — generate documentation based on config file.
• --pseudo-realtime[=<speedup>] — enable pseudo-realtime for performance evaluation (default 1).
• --load-seeds <file> — load seeds from given file.
• --save-seeds <file> — save seeds to given file.

---

The following option is available only when Zeek is built with the --enable-debug configure option:

• -B, --debug <dbgstreams> — Enable debugging output for selected streams ('-B help' for help).

The following options are available only when Zeek is built with gperftools support (use the --enable-perftools and --enable-perftools-debug configure options):

• -m, --mem-leaks — show leaks.
• -M, --mem-profile — record heap.

---

🌈 ENVIRONMENT 🌈

• ZEEKPATH — file search path.
• ZEEK_PLUGIN_PATH — plugin search path.
• ZEEK_PLUGIN_ACTIVATE — plugins to always activate.
• ZEEK_PREFIXES — prefix list.
• ZEEK_DNS_FAKE — disable DNS lookups.
• ZEEK_SEED_FILE — file to load seeds from.
• ZEEK_LOG_SUFFIX — ASCII log file extension.
• ZEEK_PROFILER_FILE — Output file for script execution statistics.
• ZEEK_DISABLE_ZEEKYGEN — Disable Zeekygen (Broxygen) documentation support.

---

💜 OUTPUT FORMAT 💜

Output is written in multiple files depending on configuration. The default location is the current directory. 🏠

The output written by Zeek can be formatted in multiple ways using the logging framework.

The default are files in human-readable (ASCII) format. The data is organized into columns (tab-delimited). The data can be processed using, e.g., the zeek-cut tool. Slay.

---

⭐ EXAMPLES ⭐

Read a capture file and generate the default logs:

# zeek -r test-capture.pcap

When running on live traffic, Zeek is usually started by running zeekctl. To configure Zeek with an initial configuration, install, and restart:

# zeekctl deploy

📝 Note: the zeekctl configuration may need to be updated before first use. Especially the network interface used should be the correct one. (Check it twice, bestie, fr fr.)

---

👑 SEE ALSO 👑

zeekctl(8) zeek-cut(1)

---

🌸 AUTHOR 🌸

zeek was written by The Zeek Project <info@zeek.org>.

---

okay that's the whole page, you ate that 💅 — this was zeek, from the System Administration Utilities manual, dated November 2014, version vibes included. Go forth and analyze some traffic, bestie 🦋✨