Zeek (formerly known as Bro) is a powerful framework for network traffic analysis and security monitoring.
Zeek also supports a wide range of traffic analysis tasks beyond the security domain, including performance measurement and troubleshooting.
Zeek runs on commodity hardware and hence provides a low-cost alternative to expensive proprietary solutions.
This is free and open source software.
Key Features
- In-depth Analysis Zeek ships with analyzers for many protocols, enabling high-level semantic analysis at the application layer.
- Adaptable and Flexible Zeek’s domain-specific scripting language enables site-specific monitoring policies and means that it is not restricted to any particular detection approach.
- Efficient Zeek targets high-performance networks and is used operationally at a variety of large sites.
- Highly Stateful Zeek keeps extensive application-layer state about the network it monitors and provides a high-level archive of a network’s activity.
- Built-in functionality for a range of analysis and detection tasks, including extracting files from HTTP sessions, detecting malware by interfacing to external registries, reporting vulnerable versions of software seen on the network, identifying popular web applications, detecting SSH brute-forcing, validating SSL certificate chains, and much more.
- Fully customizable and extensible platform for traffic analysis. Zeek provides users a domain-specific, Turing-complete scripting language for expressing arbitrary analysis tasks
Website: zeek.org
Support: Documentation, GitHub Code Repository
Developer: The Regents of the University of California through the Lawrence Berkeley National Laboratory and the International Computer Science Institute
License: BSD License
Zeek is written in C++. Learn C++ with our recommended free books and free tutorials.
Related Software
| Network Intrusion Detection Systems | |
|---|---|
| Snort | Intrusion detection/prevention with real-time traffic analysis/packet logging |
| Suricata | High performance Network IDS, IPS and Network Security Monitoring engine |
| Zeek | (formerly Bro) Powerful network analysis framework |
| Maltrail | Lightweight malicious traffic detection system |
| Kismet | Wireless intrusion detection, wireless network and device detector, and more |
| Slips | Intrusion detection and prevention system |
| Sagan | Multi-threads, high performance log analysis engine |
| psad | Intrusion detection and log analysis with iptables |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.