# Zeek **URL:** https://community.zeek.org/c/zeek/6.md [Latest](https://community.zeek.org/latest.md) · [Categories](https://community.zeek.org/categories.md) · [Tags](https://community.zeek.org/tags.md) --- ## [About the Zeek category](https://community.zeek.org/t/about-the-zeek-category/12)
**Author:** [@system](https://community.zeek.org/u/system)\ **Replies:** 0\ **Last updated:** [May 5, 2022, 12:51pm UTC](https://community.zeek.org/t/about-the-zeek-category/12 "2022-05-05T12:51:11Z")
This is the category for general Zeek discussions. If you have questions about Zeek, want to present your new script or package - or anything else that does not fit the other categories - post it here. --- ## [Zeek 8.2.2 - Ja4 fingerprint calc for tcp inner packets of geneve decapsulated](https://community.zeek.org/t/zeek-8-2-2-ja4-fingerprint-calc-for-tcp-inner-packets-of-geneve-decapsulated/8071)
**Author:** [@RicardoValverde](https://community.zeek.org/u/RicardoValverde)\ **Replies:** 3\ **Last updated:** [September 16, 2026, 7:35am UTC](https://community.zeek.org/t/zeek-8-2-2-ja4-fingerprint-calc-for-tcp-inner-packets-of-geneve-decapsulated/8071 "2026-09-16T07:35:42Z")
Hi. I installed Zeek 8.2.2 in RH9 in order to strip geneve packets and extract metadata of inner packets, adding fields like geneve src and dst IPs and VNI for future searches in Opensearch. The fields I could add and i… --- ## [Zeek 9 stumbles and thoughts](https://community.zeek.org/t/zeek-9-stumbles-and-thoughts/8072)
**Author:** [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Replies:** 7\ **Last updated:** [September 15, 2026, 8:22pm UTC](https://community.zeek.org/t/zeek-9-stumbles-and-thoughts/8072 "2026-09-15T20:22:52Z")
On ubuntu 22 (still supported) I had to: export CXX=g++-12 export CC=gcc-12 in order to get zeek 9 to compile. After installing I was met with: Warning: zeekctl netstats and print commands with cluster backend 'Zero… --- ## [Sloth: small passive C99 sensor that emits Zeek-friendly JSONL](https://community.zeek.org/t/sloth-small-passive-c99-sensor-that-emits-zeek-friendly-jsonl/8066)
**Author:** [@spacetrucker](https://community.zeek.org/u/spacetrucker)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 7:16pm UTC](https://community.zeek.org/t/sloth-small-passive-c99-sensor-that-emits-zeek-friendly-jsonl/8066 "2026-09-03T19:16:09Z")
Hi all. Sharing a small side-tool that plays well with Zeek workflows. Sloth is a passive terminal monitor for Linux written in C99 with no third-party deps. It is not a Zeek replacement. It is a lightweight sensor you … --- ## [Azure Deployment/Monitoring](https://community.zeek.org/t/azure-deployment-monitoring/8012)
**Author:** [@zorgtheblue](https://community.zeek.org/u/zorgtheblue)\ **Replies:** 4\ **Last updated:** [September 3, 2026, 1:54am UTC](https://community.zeek.org/t/azure-deployment-monitoring/8012 "2026-09-03T01:54:57Z")
I am actively building out an Azure environment and would love to include Zeek in the environment for IDS and monitoring. Are there any deployment models for how (if possible) this can be achieved? Azure network TAP/SPA… --- ## [Update from zeek 7.0 to 8.x](https://community.zeek.org/t/update-from-zeek-7-0-to-8-x/8056)
**Author:** [@georgio](https://community.zeek.org/u/georgio)\ **Replies:** 1\ **Last updated:** [September 2, 2026, 10:35am UTC](https://community.zeek.org/t/update-from-zeek-7-0-to-8-x/8056 "2026-09-02T10:35:23Z")
Hello I have some issues when I tried to update from 7.0 to 8 Preparing to unpack …/0-zeek-8.0-core\_8.0.1-0\_amd64.deb … Unpacking zeek-8.0-core (8.0.1-0) … dpkg: error processing archive /tmp/apt-dpkg-install/0-zeek-8.0… --- ## [Using systemd deployment method with PF\_RING](https://community.zeek.org/t/using-systemd-deployment-method-with-pf-ring/8055)
**Author:** [@redbaron](https://community.zeek.org/u/redbaron)\ **Replies:** 7\ **Last updated:** [August 27, 2026, 9:11am UTC](https://community.zeek.org/t/using-systemd-deployment-method-with-pf-ring/8055 "2026-08-27T09:11:12Z")
Hi, Zeek-8.1 has added a Systemd generator deployment method and the docs show how to deploy Zeek cluster on a single node. We have been using zeekctl to deploy Zeek using PF\_RING as load balancer till now. However, fr… --- ## [Hitting Error Dictionary insertion distance too far: 65535](https://community.zeek.org/t/hitting-error-dictionary-insertion-distance-too-far-65535/7978)
**Author:** [@rachit](https://community.zeek.org/u/rachit)\ **Replies:** 13\ **Last updated:** [August 24, 2026, 1:03pm UTC](https://community.zeek.org/t/hitting-error-dictionary-insertion-distance-too-far-65535/7978 "2026-08-24T13:03:15Z")
Hello everyone, I’m new to Zeek, and I’m trying to process large pcap files using zeek -r \. Currently, since my pcap file too large to process in one run, I’m using editcap to split them into manageable chunks tha… --- ## [Zeek log production for decrypted https traffic on port 443](https://community.zeek.org/t/zeek-log-production-for-decrypted-https-traffic-on-port-443/7993)
**Author:** [@fi2019](https://community.zeek.org/u/fi2019)\ **Replies:** 2\ **Last updated:** [August 21, 2026, 9:23am UTC](https://community.zeek.org/t/zeek-log-production-for-decrypted-https-traffic-on-port-443/7993 "2026-08-21T09:23:47Z")
Hi team, I am new to zeek and trying to learn zeek. I have already decrypted https traffic on port 443 which I want to feed to zeek to produce logs but usually zeek throw error as it see decrypted traffic on port 443. H… --- ## [Zeek on Debian (15 character title requirement is kind of silly)](https://community.zeek.org/t/zeek-on-debian-15-character-title-requirement-is-kind-of-silly/7995)
**Author:** [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Replies:** 4\ **Last updated:** [July 20, 2026, 1:45pm UTC](https://community.zeek.org/t/zeek-on-debian-15-character-title-requirement-is-kind-of-silly/7995 "2026-07-20T13:45:57Z")
Hey all. Topic :slight\_smile: I’m sure Debian 13.5 and zeek will run just fine, my concern is over time maybe something like cmake doesn’t get upgraded, but a new version will be required for the latest zeek (cmake is … --- ## [Zeek Telemetry /services.json issue](https://community.zeek.org/t/zeek-telemetry-services-json-issue/8000)
**Author:** [@blairmcc03](https://community.zeek.org/u/blairmcc03)\ **Replies:** 3\ **Last updated:** [June 16, 2026, 12:51pm UTC](https://community.zeek.org/t/zeek-telemetry-services-json-issue/8000 "2026-06-16T12:51:09Z")
Hi, I am trying to set up metric exporting in Zeek following the documentation here. So far I’ve been reasonably successful and have all of my nodes exporting metrics to their respective ports and can see these on the /… --- ## [Packet loss and compilation issues with PF\_RING plugin on Zeek 8.0.6 (3.5 Gbps traffic)](https://community.zeek.org/t/packet-loss-and-compilation-issues-with-pf-ring-plugin-on-zeek-8-0-6-3-5-gbps-traffic/7942)
**Author:** [@puma2009](https://community.zeek.org/u/puma2009)\ **Replies:** 5\ **Last updated:** [April 7, 2026, 2:51pm UTC](https://community.zeek.org/t/packet-loss-and-compilation-issues-with-pf-ring-plugin-on-zeek-8-0-6-3-5-gbps-traffic/7942 "2026-04-07T14:51:34Z")
Hi everyone, I’m struggling to get Zeek 8.0.6 to work with PF\_RING on a high-traffic sensor. I’m experiencing 80% packet loss at 3.5 Gbps, which is corrupting our file extraction (SMTP/Email). System Environment: O… --- ## [Zeek memory Limit](https://community.zeek.org/t/zeek-memory-limit/7936)
**Author:** [@trong](https://community.zeek.org/u/trong)\ **Replies:** 6\ **Last updated:** [January 22, 2026, 9:08am UTC](https://community.zeek.org/t/zeek-memory-limit/7936 "2026-01-22T09:08:48Z")
Hello everyone, I’m running Zeek 6.0.1 with the DPDK ESnet plugin. and trying to limit Zeek’s memory usage. I’m currently testing two approaches: Zeek’s Memlimit and setting memory limits via systemd (systemctl). But i… --- ## [Unable to generate intel.log](https://community.zeek.org/t/unable-to-generate-intel-log/7955)
**Author:** [@Pixelbrain](https://community.zeek.org/u/Pixelbrain)\ **Replies:** 2\ **Last updated:** [March 13, 2026, 12:20pm UTC](https://community.zeek.org/t/unable-to-generate-intel-log/7955 "2026-03-13T12:20:17Z")
I’m trying to detect connections to specific IP addresses using the Intelligence framework. I read the documentation, however I have trouble getting even a basic test scenario working. No matter what I do, it seems like… --- ## [Zeek filters problem](https://community.zeek.org/t/zeek-filters-problem/7954)
**Author:** [@jannitand](https://community.zeek.org/u/jannitand)\ **Replies:** 1\ **Last updated:** [March 12, 2026, 5:11pm UTC](https://community.zeek.org/t/zeek-filters-problem/7954 "2026-03-12T17:11:24Z")
Hello, I’m new to zeek so my apologies if I’m asking a nonsense question. I’ve installed Zeek as a network monitoring tool in a network which is not under my administration. The port mirroring in the interface zeek is … --- ## [Need Guidance on Enabling IMAP Attachment Extraction in Zeek](https://community.zeek.org/t/need-guidance-on-enabling-imap-attachment-extraction-in-zeek/7951)
**Author:** [@hareem2004](https://community.zeek.org/u/hareem2004)\ **Replies:** 1\ **Last updated:** [March 3, 2026, 3:47pm UTC](https://community.zeek.org/t/need-guidance-on-enabling-imap-attachment-extraction-in-zeek/7951 "2026-03-03T15:47:16Z")
Hello everyone, I am currently working on a solution that will use Zeek where we need to analyze email traffic at the protocol level and extract attachments. For other protocols like SMTP ,POP3 etc attachment extractio… --- ## [Zeek-spicy-wireguard plugin v0.1.8 fails to install](https://community.zeek.org/t/zeek-spicy-wireguard-plugin-v0-1-8-fails-to-install/7946)
**Author:** [@0x4A6F686E](https://community.zeek.org/u/0x4A6F686E)\ **Replies:** 2\ **Last updated:** [February 10, 2026, 10:27am UTC](https://community.zeek.org/t/zeek-spicy-wireguard-plugin-v0-1-8-fails-to-install/7946 "2026-02-10T10:27:30Z")
Hi all, I tried to install the zeek/corelight/zeek-spicy-wireguard plugin, version 0.1.8 using “zkg install”. This fails with the following error: error: failed to run tests for “zeek/corelight/zeek-spicy-wireguard”: … --- ## [Zeek script about WASM](https://community.zeek.org/t/zeek-script-about-wasm/7945)
**Author:** [@liuchuang](https://community.zeek.org/u/liuchuang)\ **Replies:** 2\ **Last updated:** [February 9, 2026, 12:14pm UTC](https://community.zeek.org/t/zeek-script-about-wasm/7945 "2026-02-09T12:14:52Z")
Using the zeek (.zeek) script language has a learning curve. Are there any plans to use WebAssembly technology to enable scripting plugins in other languages (such as Rust or)? --- ## [“Ignoring corrupt line” error in trace-summary after upgrading Zeek](https://community.zeek.org/t/ignoring-corrupt-line-error-in-trace-summary-after-upgrading-zeek/7941)
**Author:** [@kransom](https://community.zeek.org/u/kransom)\ **Replies:** 2\ **Last updated:** [February 3, 2026, 3:56pm UTC](https://community.zeek.org/t/ignoring-corrupt-line-error-in-trace-summary-after-upgrading-zeek/7941 "2026-02-03T15:56:44Z")
I inherited an older Zeek server running version 4 and Debian 10. After upgrading to Debian 12 and Zeek version 7, we receive the following lines frequently in our reports. Before upgrading, those lines did appear in rep… --- ## [Using Zeek to monitor IoT device traffic](https://community.zeek.org/t/using-zeek-to-monitor-iot-device-traffic/7926)
**Author:** [@aria\_22](https://community.zeek.org/u/aria_22)\ **Replies:** 1\ **Last updated:** [February 3, 2026, 3:54pm UTC](https://community.zeek.org/t/using-zeek-to-monitor-iot-device-traffic/7926 "2026-02-03T15:54:03Z")
Hi everyone, I’m exploring ways to use Zeek to monitor network traffic from a fleet of IoT devices (ESP32, Raspberry Pi, etc.) and want to understand what kinds of traffic patterns or scripts work best for detecting unus… --- ## [HTTP2 Analyzer Plugin](https://community.zeek.org/t/http2-analyzer-plugin/7937)
**Author:** [@georgio](https://community.zeek.org/u/georgio)\ **Replies:** 2\ **Last updated:** [January 23, 2026, 8:51am UTC](https://community.zeek.org/t/http2-analyzer-plugin/7937 "2026-01-23T08:51:53Z")
Hey there, I tried to install the HTTP2 analyzer GitHub - MITRECND/bro-http2: Plugin for Zeek/Bro which provides http2 decoder/analyzer But i get this error line 181: identifier not defined: http2\_stream\_stat The prob… --- ## [Compiling Zeek-8.1 for Rocky linux with GCC-11 fails](https://community.zeek.org/t/compiling-zeek-8-1-for-rocky-linux-with-gcc-11-fails/7935)
**Author:** [@redbaron](https://community.zeek.org/u/redbaron)\ **Replies:** 3\ **Last updated:** [January 13, 2026, 3:42pm UTC](https://community.zeek.org/t/compiling-zeek-8-1-for-rocky-linux-with-gcc-11-fails/7935 "2026-01-13T15:42:57Z")
Hi, I was trying to build Zeek-8.1 RPM for Rocky 8 and 9 but it is failing at compile stage. For context, we build Zeek RPMs for Rocky8/9 using a spec file and rpmbuildtool. Zeek-8.0.3 was built with GCC-10 (toolset-g… --- ## [Add the zeek\_filename="xxx.log" tag before the JSONL string](https://community.zeek.org/t/add-the-zeek-filename-xxx-log-tag-before-the-jsonl-string/7896)
**Author:** [@alexdinoon](https://community.zeek.org/u/alexdinoon)\ **Replies:** 5\ **Last updated:** [January 2, 2026, 8:14pm UTC](https://community.zeek.org/t/add-the-zeek-filename-xxx-log-tag-before-the-jsonl-string/7896 "2026-01-02T20:14:16Z")
Hello everyone, I need to send Zeek logs to Cisco SNA. According to the Cisco manual: “Format: The Zeek log generator must add the zeek\_filename="xxx.log" tag before the JSONL string for the Flow Collector.” I need h… --- ## [Multiple PCAP files](https://community.zeek.org/t/multiple-pcap-files/7921)
**Author:** [@Forensic4Starters](https://community.zeek.org/u/Forensic4Starters)\ **Replies:** 3\ **Last updated:** [December 19, 2025, 5:31am UTC](https://community.zeek.org/t/multiple-pcap-files/7921 "2025-12-19T05:31:08Z")
Hey, I am trying to learn network forensics and want to use zeek. In my course we have hundreds of PCAPs. They do have connections spanning over multiple PCAPs. Is there an easy way to let zeek “combine” those by itself… --- ## [Delete logs after rotating](https://community.zeek.org/t/delete-logs-after-rotating/7919)
**Author:** [@Artyom\_Kalabukhov](https://community.zeek.org/u/Artyom_Kalabukhov)\ **Replies:** 0\ **Last updated:** [December 16, 2025, 7:54am UTC](https://community.zeek.org/t/delete-logs-after-rotating/7919 "2025-12-16T07:54:33Z")
I encountered a situation where I needed logs to be written at runtime, but after rotation, the log files should not be saved and archived, but deleted. In the log policy, I found variables for enabling, disabling, and … --- ## [Errors in FreeBSD 15 using ZeroMQ](https://community.zeek.org/t/errors-in-freebsd-15-using-zeromq/7917)
**Author:** [@clopmz](https://community.zeek.org/u/clopmz)\ **Replies:** 3\ **Last updated:** [December 11, 2025, 10:35am UTC](https://community.zeek.org/t/errors-in-freebsd-15-using-zeromq/7917 "2025-12-11T10:35:12Z")
Hi all, I have compiled Zeek 8.0.4 enabling ZeroMQ support under a FreeBSD 15 host (amd64) but zeekctl returns the following errors: hecking configurations … Traceback (most recent call last): File “/opt/zeek/bin/zee… --- ## [Is there anyone maintain the Kafka plugin](https://community.zeek.org/t/is-there-anyone-maintain-the-kafka-plugin/7910)
**Author:** [@josen](https://community.zeek.org/u/josen)\ **Replies:** 4\ **Last updated:** [December 8, 2025, 1:05am UTC](https://community.zeek.org/t/is-there-anyone-maintain-the-kafka-plugin/7910 "2025-12-08T01:05:36Z")
I am using Zeek Kafka plugin (GitHub - SeisoLLC/zeek-kafka: A Zeek log writer plugin that publishes to Kafka. · GitHub) and following the document to install the plugin manually. But I encountered some issues when I dep… --- ## [Zeek IPS Functionality](https://community.zeek.org/t/zeek-ips-functionality/7901)
**Author:** [@kaushalshriyan](https://community.zeek.org/u/kaushalshriyan)\ **Replies:** 2\ **Last updated:** [November 18, 2025, 5:30am UTC](https://community.zeek.org/t/zeek-ips-functionality/7901 "2025-11-18T05:30:36Z")
Hi, Can Zeek be used as an IPS, or is it strictly an IDS without any packet-blocking capabilities? Is there a way to enable Zeek-based IPS through external integrations or additional tools? Please guide me. Thanks in a… --- ## [Register packet analyser for Multicast mac address](https://community.zeek.org/t/register-packet-analyser-for-multicast-mac-address/7899)
**Author:** [@biswa61](https://community.zeek.org/u/biswa61)\ **Replies:** 2\ **Last updated:** [November 12, 2025, 5:07pm UTC](https://community.zeek.org/t/register-packet-analyser-for-multicast-mac-address/7899 "2025-11-12T17:07:36Z")
Hi, I am trying to extend below spicy parser to support Profinet ptcp protocol. profinet-parser I have added PTCP frame like below . The packet which I am using is having multicast DMAC: 01:80:C2:00:00:0E and SMAC: un… --- ## [Postgresql Writer cause crashed?](https://community.zeek.org/t/postgresql-writer-cause-crashed/7884)
**Author:** [@trong](https://community.zeek.org/u/trong)\ **Replies:** 1\ **Last updated:** [November 7, 2025, 3:45pm UTC](https://community.zeek.org/t/postgresql-writer-cause-crashed/7884 "2025-11-07T15:45:32Z")
Hello everyone, I’m currently using Zeek version 6.0.2 and running it with the PostgreSQL Writer plugin. However, my program frequently crashes. It crashed at 05:00 AM today, it seems like my postgresql server was dead … [Next page](https://community.zeek.org/c/zeek/6.md?page=1)