Analyse PCAPs with Zeek¶
Use Zeek directly against an authorised interface or a saved packet capture and direct the resulting logs to a known location.
Before you begin
Use an authorised lab host and record the Zeek version, operating-system version, interface name, and command output used for validation.
Zeek as a Command-Line Utility¶
If you prefer not to use ZeekControl (e.g., you don’t need its automation and management features), here’s how to directly control Zeek for your analysis activities from the command line for both live traffic and offline working from traces.
Monitoring Live Traffic¶
Analysing live traffic from an interface is simple:
ens32 should be replaced by the interface on which you want to monitor the traffic. The standard base scripts will be loaded and enabled by default. A list of additional scripts can be provided in the command as indicated above by <list of scripts to load>. Any such scripts supplied as space-separated files or paths will be loaded by Zeek in addition to the standard base scripts.
Zeek will output log files into the current working directory.
Reading Packet Capture (pcap) Files¶
When you want to do offline analysis of already captured pcap files, Zeek is a very handy tool to analyse the pcap and gives a high level holistic view of the traffic captured in the pcap.
If you want to capture packets from an interface and write them to a file to later analyse it with Zeek, then it can be done like this:
Where ens32 should be replaced by the correct interface for your system, for example as shown by the ifconfig command. (The -s 0 argument tells it to capture whole packets; in cases where it is not supported, use -s 65535 instead).
After capturing traffic for a while, kill the tcpdump (with ctrl-c), and tell Zeek to perform all the default analysis on the capture:
Zeek will output log files into the current working directory.
To specify the output directory for logs, you can set Log::default_logdir on the command line:
If no logs are generated for a pcap, try to run the pcap with -C to tell Zeek to ignore invalid IP Checksums:
If you are interested in more detection, you can load the local.zeek script that is included as a suggested configuration:
If you want to run a custom or an extra script (assuming it’s in the default search path, more on this in the next section) to detect any particular behavior in the pcap, run Zeek with following command:
PCAP-analysis checkpoint
Confirm that processing the capture creates conn.log and any protocol logs expected from the traffic.