AeonDave Zeek
PCAP → structured protocol logs. Extracts DNS, HTTP, TLS, files, connections into queryable log files.
Installation
# Debian/Ubuntu/Kali
sudo apt install zeek
# or
sudo apt install zeek-core zeekctl
# macOS
brew install zeek
# Docker (no install)
docker run -v $(pwd):/pcap -w /pcap zeek/zeek zeek -r capture.pcap
# Verify
zeek --version
Basic Usage
# Analyze PCAP — generates log files in current directory
zeek -r capture.pcap
# JSON output (easier to parse)
zeek -r capture.pcap LogAscii::use_json=T
# Live capture
zeek -i eth0 -C # -C ignores checksum errors (common on virtualized interfaces)
# Analyze with all scripts (more detailed output)
zeek -r capture.pcap local
Log Files Reference
After running Zeek, logs appear in the current directory:
| Log file | Content |
|---|---|
conn.log |
All TCP/UDP/ICMP connections: IPs, ports, bytes, duration, state |
dns.log |
DNS queries and responses — domains, record types, answers |
http.log |
HTTP requests/responses — method, URI, host, user-agent, status, mime |
ssl.log |
TLS handshakes — SNI, certificate subject, version, cipher |
x509.log |
Certificate details — subject, issuer, validity |
files.log |
Files transferred — MD5, SHA1, MIME, source/dest |
smtp.log |
Email metadata |
ftp.log |
FTP commands and responses |
ssh.log |
SSH connection details |
dhcp.log |
DHCP requests/leases |
weird.log |
Protocol anomalies — malformed packets, unusual behavior |
notice.log |
Zeek-generated alerts (scanning, brute force, etc.) |
capture_loss.log |
Packet drops during capture |
zeek-cut: Fast Log Querying
zeek-cut extracts specific columns from Zeek tab-separated logs.
# Extract specific fields from conn.log
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p proto bytes_recv
# Extract DNS query names
cat dns.log | zeek-cut query
# Top DNS queries
cat dns.log | zeek-cut query | sort | uniq -c | sort -rn | head 20
# HTTP hostnames + URIs
cat http.log | zeek-cut host uri | sort -u
# TLS SNI names
cat ssl.log | zeek-cut server_name | sort | uniq -c | sort -rn
# Unique destination IPs + ports
cat conn.log | zeek-cut id.resp_h id.resp_p | sort -u
Investigation Workflows
Workflow 1: PCAP quick triage
zeek -r capture.pcap 2>/dev/null
# Top talkers (most bytes sent)
cat conn.log | zeek-cut id.orig_h orig_bytes | sort -t$'\t' -k2 -rn | head 10
# Top destinations
cat conn.log | zeek-cut id.resp_h id.resp_p | sort | uniq -c | sort -rn | head 20
# Protocols seen
cat conn.log | zeek-cut proto | sort | uniq -c
# Connection states (S1=established, RSTO=reset, SF=normal close, etc.)
cat conn.log | zeek-cut conn_state | sort | uniq -c | sort -rn
Workflow 2: DNS analysis
# All queried domains
cat dns.log | zeek-cut query | sort | uniq -c | sort -rn
# DNS over specific port (look for DNS tunneling on non-53)
cat conn.log | zeek-cut id.resp_p proto | grep "^53" | wc -l
# Unusually long DNS names (tunneling indicator)
cat dns.log | zeek-cut query | awk 'length($0) > 50'
# DNS answers (what IPs domains resolved to)
cat dns.log | zeek-cut query answers | grep -v "-"
# Failed DNS lookups
cat dns.log | zeek-cut query rcode_name | grep -v "NOERROR"
# Find specific domain
cat dns.log | zeek-cut ts query answers | grep "evil.com"
Workflow 3: HTTP analysis
# All HTTP hosts + URIs
cat http.log | zeek-cut host uri method status_code | head 50
# POST requests (data exfiltration / form submits)
cat http.log | zeek-cut host uri method | grep "^POST\| POST"
# or
awk -F'\t' '$13 == "POST"' http.log | zeek-cut host uri
# User agents (malware often uses static or unusual UAs)
cat http.log | zeek-cut user_agent | sort | uniq -c | sort -rn
# File downloads
cat http.log | zeek-cut host uri resp_mime_types | grep -v "text/html\|text/css\|image"
# Unusual status codes
cat http.log | zeek-cut host uri status_code | grep -v "200\|301\|302\|304"
# Find specific string in URIs
cat http.log | zeek-cut uri | grep -i "shell\|cmd\|upload\|admin\|backdoor"
Workflow 4: TLS/SSL certificate analysis
# SNI names (what domains TLS connections go to)
cat ssl.log | zeek-cut server_name | sort | uniq -c | sort -rn
# Self-signed or unusual certs
cat ssl.log | zeek-cut server_name validation_status | grep -v "ok\|-"
# TLS version distribution (look for old TLS 1.0/1.1)
cat ssl.log | zeek-cut version | sort | uniq -c
# Certificate subject (from x509.log)
cat x509.log | zeek-cut certificate.subject certificate.issuer | head 20
# JA3 fingerprints (malware TLS fingerprinting)
cat ssl.log | zeek-cut ja3 ja3s server_name | sort -u
Workflow 5: File extraction
# Files detected in traffic
cat files.log | zeek-cut filename mime_type md5 sha1 tx_hosts
# Extract files from PCAP (requires file extraction script)
zeek -r capture.pcap extract-all-files.zeek
ls extract_files/
# Or with built-in script
zeek -r capture.pcap frameworks/files/extract-all-files.zeek FileExtract::PREFIX="files/"
# Find by MIME type
cat files.log | zeek-cut filename mime_type | grep -i "application/x-executable\|application/x-dosexec\|application/zip"
Workflow 6: Anomaly detection
# Check weird.log for protocol anomalies
cat weird.log | zeek-cut name peer | sort | uniq -c | sort -rn
# Scan detection in conn.log (many connections, short duration)
cat conn.log | zeek-cut id.orig_h id.resp_h duration | awk -F'\t' '$3 < 0.1' | wc -l
# Long connections (C2 beaconing)
cat conn.log | zeek-cut id.orig_h id.resp_h duration | sort -t$'\t' -k3 -rn | head 10
# Beaconing pattern: many equal-interval connections to same host
cat conn.log | zeek-cut ts id.orig_h id.resp_h | grep "SUSPECT_IP" | awk '{print $1}' | \
awk 'NR>1{printf "%.0f\n", $1-prev} {prev=$1}' | sort | uniq -c
# Large data transfers (exfiltration)
cat conn.log | zeek-cut id.orig_h id.resp_h orig_bytes resp_bytes | \
awk -F'\t' '$3 > 1000000 || $4 > 1000000' | sort -t$'\t' -k3 -rn
Workflow 7: Credential and sensitive data hunting
# HTTP Basic Auth (base64 credentials in headers)
cat http.log | zeek-cut host uri username password | grep -v "^-"
# FTP credentials
cat ftp.log | zeek-cut user password | grep -v "^-\|-$"
# SMTP from/to
cat smtp.log | zeek-cut mailfrom rcptto | grep -v "^-"
Common Field Reference
conn.log key fields:
ts - timestamp
uid - unique connection ID (pivot key)
id.orig_h - source IP
id.orig_p - source port
id.resp_h - destination IP
id.resp_p - destination port
proto - tcp/udp/icmp
service - detected protocol
duration - connection duration
orig_bytes - bytes sent by originator
resp_bytes - bytes sent by responder
conn_state - S1/SF/S0/REJ/RSTO etc
conn_state values:
| State | Meaning |
|---|---|
SF |
Normal established + closed |
S0 |
SYN sent, no response (host down/filtered) |
S1 |
Established, not closed (ongoing or truncated) |
REJ |
Connection rejected (RST) |
RSTO |
Originator sent RST |
OTH |
Mid-stream/no SYN seen |
Cross-Log Correlation via UID
The uid field connects related entries across log files.
# Find suspicious connection UID
cat conn.log | zeek-cut uid id.resp_h id.resp_p | grep "evil.com_IP"
# Use uid to find HTTP activity
cat http.log | zeek-cut uid host uri | grep "SUSPECT_UID"
# Use uid to find transferred files
cat files.log | zeek-cut uid filename md5 | grep "SUSPECT_UID"
# Full correlation script
UID="CuV6ij35YMRJBbIEr1"
cat conn.log | zeek-cut uid id.orig_h id.resp_h | grep "$UID"
cat http.log | zeek-cut uid host uri method | grep "$UID"
cat files.log | zeek-cut uid filename mime_type md5 | grep "$UID"
Quick Tricks
# Find investigation indicators in HTTP URIs or bodies
cat http.log | zeek-cut uri | grep -iE "token|secret|key|indicator"
# Find cleartext credentials in HTTP
cat http.log | zeek-cut host uri username password | awk -F'\t' '$4 != "-"'
# Convert Zeek timestamps to human-readable
cat conn.log | zeek-cut ts id.resp_h | awk '{print strftime("%Y-%m-%d %H:%M:%S", $1), $2}'
# Count connections per minute (detect bursts)
cat conn.log | zeek-cut ts | awk '{print strftime("%H:%M", $1)}' | uniq -c
# Extract all domains ever queried
cat dns.log | zeek-cut query | sort -u > all_domains.txt
Integration
| Tool | Use case |
|---|---|
wireshark / tshark |
Deep packet inspection after Zeek identifies the session |
tcpdump |
Initial PCAP acquisition |
strings / binwalk |
Analyze extracted files from files.log |
jq |
Parse JSON-format Zeek logs |
yara |
Scan extracted file objects for malware signatures |
openssl |
Inspect certificate details from x509.log |
Resources
| File | When to load |
|---|---|
references/ |
Zeek scripting basics, custom log fields, DNS tunneling detection, JA3 usage |