# Zeek **URL:** https://community.zeek.org/c/zeek/6.md?page=1 [Latest](https://community.zeek.org/latest.md) · [Categories](https://community.zeek.org/categories.md) · [Tags](https://community.zeek.org/tags.md) **Page:** 2 --- ## [Recent upgrades to the packages.zeek.org site](https://community.zeek.org/t/recent-upgrades-to-the-packages-zeek-org-site/7895)
**Author:** [@Tim\_Wojtulewicz](https://community.zeek.org/u/Tim_Wojtulewicz)\ **Replies:** 0\ **Last updated:** [November 5, 2025, 10:35pm UTC](https://community.zeek.org/t/recent-upgrades-to-the-packages-zeek-org-site/7895 "2025-11-05T22:35:15Z")
Over the last few months, the packages website (https://packages.zeek.org) went through a major upgrade. Initially it was an effort to move the entire site to Docker, instead of running directly on the AWS instance that … --- ## [Hiring: Short-Term Fraud Analysts w/Zeek Experience (4 hours, remote, $200)](https://community.zeek.org/t/hiring-short-term-fraud-analysts-w-zeek-experience-4-hours-remote-200/7886)
**Author:** [@hassaan](https://community.zeek.org/u/hassaan)\ **Replies:** 1\ **Last updated:** [November 3, 2025, 4:34pm UTC](https://community.zeek.org/t/hiring-short-term-fraud-analysts-w-zeek-experience-4-hours-remote-200/7886 "2025-11-03T16:34:15Z")
Hiring: Short-Term Fraud Analysts (4 hours, remote) Conway is building an anomaly-detection engine to help analysts detect and prevent fraud faster. Do a paid, 4-hour task: review a dataset, find fraud events, and annot… --- ## [Creating x509.log from Parsed x509 Bytestring](https://community.zeek.org/t/creating-x509-log-from-parsed-x509-bytestring/7881)
**Author:** [@Zeek\_Noob](https://community.zeek.org/u/Zeek_Noob)\ **Replies:** 0\ **Last updated:** [October 27, 2025, 11:57am UTC](https://community.zeek.org/t/creating-x509-log-from-parsed-x509-bytestring/7881 "2025-10-27T11:57:25Z")
Hey Community, I have a x509 Certificate from a Byte-string in a local variable. I want to save it as a file and create the corresponding entry in the x509.log. How do I accomplish that? Something like: local cert: st… --- ## [The problem of log rotation and pcap files in the zeek](https://community.zeek.org/t/the-problem-of-log-rotation-and-pcap-files-in-the-zeek/7875)
**Author:** [@moho](https://community.zeek.org/u/moho)\ **Replies:** 0\ **Last updated:** [October 5, 2025, 1:58pm UTC](https://community.zeek.org/t/the-problem-of-log-rotation-and-pcap-files-in-the-zeek/7875 "2025-10-05T13:58:40Z")
I want to disable log rotation in the zeek it creates lot of folder in the /opt/zeek/logs/current/ and put log files in it and archive them. I don’t want this behavior because of that I disabled the log rotation interval… --- ## [Zeek 8 Megathread](https://community.zeek.org/t/zeek-8-megathread/7869)
**Author:** [@michelle](https://community.zeek.org/u/michelle)\ **Replies:** 0\ **Last updated:** [August 25, 2025, 5:19pm UTC](https://community.zeek.org/t/zeek-8-megathread/7869 "2025-08-25T17:19:58Z")
This is the Zeek 8 megathread to discuss all topics related to the recent release. Purpose This is a place to: Share your experiences upgrading or running Zeek 8 Ask questions about new features and changes Post tips … --- ## [Shared state across multiple interfaces/workers or how to run manager/worker specific scripts](https://community.zeek.org/t/shared-state-across-multiple-interfaces-workers-or-how-to-run-manager-worker-specific-scripts/7862)
**Author:** [@klemens](https://community.zeek.org/u/klemens)\ **Replies:** 1\ **Last updated:** [August 20, 2025, 6:11pm UTC](https://community.zeek.org/t/shared-state-across-multiple-interfaces-workers-or-how-to-run-manager-worker-specific-scripts/7862 "2025-08-20T18:11:26Z")
Hi, I wrote a script caching certain data and executing commands upon new entries. Thus zeek –bare-mode –iface lo -- ./script.zeek runs permanently, watches for, say requests to foo, and executes cmd foo for the first r… --- ## [Server Requirements for zeek deployment](https://community.zeek.org/t/server-requirements-for-zeek-deployment/7866)
**Author:** [@mbasale](https://community.zeek.org/u/mbasale)\ **Replies:** 0\ **Last updated:** [August 20, 2025, 6:45am UTC](https://community.zeek.org/t/server-requirements-for-zeek-deployment/7866 "2025-08-20T06:45:56Z")
Hello We’re planning to deploy Zeek in a production environment and would appreciate your guidance on server specs. The setup will monitor live traffic and generate around 2GB of logs per day, with integration into a S… --- ## [Detect suspicious traffic using Zeek Network Security Monitor](https://community.zeek.org/t/detect-suspicious-traffic-using-zeek-network-security-monitor/7848)
**Author:** [@kaushalshriyan](https://community.zeek.org/u/kaushalshriyan)\ **Replies:** 1\ **Last updated:** [August 4, 2025, 11:20am UTC](https://community.zeek.org/t/detect-suspicious-traffic-using-zeek-network-security-monitor/7848 "2025-08-04T11:20:29Z")
Hi, I am seeking guidance on how to detect suspicious traffic using Zeek. Any support or resources you could provide would be greatly appreciated. Thanks in advance. Best regards, Kaushal --- ## [Zeek with tcpreplay](https://community.zeek.org/t/zeek-with-tcpreplay/7844)
**Author:** [@trong](https://community.zeek.org/u/trong)\ **Replies:** 4\ **Last updated:** [July 18, 2025, 9:07am UTC](https://community.zeek.org/t/zeek-with-tcpreplay/7844 "2025-07-18T09:07:24Z")
"Hi everyone, I’m using Zeek version 6.0.2-1.el9.x86\_64, and I’m trying to use tcpreplay in combination with Zeek. I’ve set up two machines on the same network: One machine runs tcpreplay with a .pcap file The other … --- ## [Enabled Parsers with No Traffic Load](https://community.zeek.org/t/enabled-parsers-with-no-traffic-load/7812)
**Author:** [@ephemeric](https://community.zeek.org/u/ephemeric)\ **Replies:** 2\ **Last updated:** [June 23, 2025, 6:24pm UTC](https://community.zeek.org/t/enabled-parsers-with-no-traffic-load/7812 "2025-06-23T18:24:03Z")
Hi, I apologise if this is a dumb question: if I run Zeek with all of the GitHub - cisagov/ICSNPP: Industrial Control Systems Network Protocol Parsers installed and enabled but no traffic is seen for any of the said par… --- ## [What to Watch For When Upgrading Zeek from 6.0.4 to 7.0.5](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718)
**Author:** [@ephemeric](https://community.zeek.org/u/ephemeric)\ **Replies:** 10\ **Last updated:** [June 22, 2025, 4:25pm UTC](https://community.zeek.org/t/what-to-watch-for-when-upgrading-zeek-from-6-0-4-to-7-0-5/7718 "2025-06-22T16:25:20Z")
We are in the unfortunate position of having to upgrade from 6.0.4 to 7.0.5 and are duly nervous. Is there anything in particular to watch for? I have looked at NEWS and CHANGES and obviously, the changes from 6.0.4 to … --- ## [Link IP address with host names from dns.log](https://community.zeek.org/t/link-ip-address-with-host-names-from-dns-log/7808)
**Author:** [@bladeliu123](https://community.zeek.org/u/bladeliu123)\ **Replies:** 0\ **Last updated:** [June 21, 2025, 6:37am UTC](https://community.zeek.org/t/link-ip-address-with-host-names-from-dns-log/7808 "2025-06-21T06:37:19Z")
Hello, Is there a proper way to link address from conn.log with host names from dns.log? There is no distinctive ‘key’ to link both logs for an unique connection. Following way hopefully works, and any robust script o… --- ## [Researching common vulnerabilities and best practices for securing Zeek deployments](https://community.zeek.org/t/researching-common-vulnerabilities-and-best-practices-for-securing-zeek-deployments/7804)
**Author:** [@Gopinath](https://community.zeek.org/u/Gopinath)\ **Replies:** 0\ **Last updated:** [June 11, 2025, 9:02am UTC](https://community.zeek.org/t/researching-common-vulnerabilities-and-best-practices-for-securing-zeek-deployments/7804 "2025-06-11T09:02:54Z")
Hello Zeek Community, I am currently working on a project to identify potential vulnerabilities within Zeek images and understand best practices for securing Zeek deployments. I would greatly appreciate it if you could… --- ## [CPU pinning in zeek](https://community.zeek.org/t/cpu-pinning-in-zeek/7796)
**Author:** [@trong](https://community.zeek.org/u/trong)\ **Replies:** 5\ **Last updated:** [June 9, 2025, 2:47pm UTC](https://community.zeek.org/t/cpu-pinning-in-zeek/7796 "2025-06-09T14:47:43Z")
I’m currently using Zeek in clustering mode and discovered that the pin\_cpus option allows me to specify which CPU cores the worker nodes should run on. Here is my config \[zeek\] type = logger host = localhost \[manager\]… --- ## [Optional Fields issue](https://community.zeek.org/t/optional-fields-issue/7798)
**Author:** [@Nourgr23](https://community.zeek.org/u/Nourgr23)\ **Replies:** 1\ **Last updated:** [June 6, 2025, 8:07am UTC](https://community.zeek.org/t/optional-fields-issue/7798 "2025-06-06T08:07:35Z")
Hello everyone, I’m currently working on developing a Zeek packet analyzer for ProfinetIO as part of my Master’s thesis. 1-From my understanding, the real-time data exchange in Profinet is not built on traditional tran… --- ## [Can Zeek detect ransomware, DDoS, and DoS attacks?](https://community.zeek.org/t/can-zeek-detect-ransomware-ddos-and-dos-attacks/7793)
**Author:** [@kaushalshriyan](https://community.zeek.org/u/kaushalshriyan)\ **Replies:** 0\ **Last updated:** [May 30, 2025, 1:50am UTC](https://community.zeek.org/t/can-zeek-detect-ransomware-ddos-and-dos-attacks/7793 "2025-05-30T01:50:10Z")
Hi, I have backed up data using rsync on a Linux system. Can Zeek detect ransomware in the backed-up data (e.g., /opt/backup/db.tar.gz)? Also, can Zeek detect DDoS and DoS types of attacks? Please guide me. Best regar… --- ## [Prometheus Exporter for Zeek](https://community.zeek.org/t/prometheus-exporter-for-zeek/7792)
**Author:** [@kaushalshriyan](https://community.zeek.org/u/kaushalshriyan)\ **Replies:** 2\ **Last updated:** [May 30, 2025, 12:02am UTC](https://community.zeek.org/t/prometheus-exporter-for-zeek/7792 "2025-05-30T00:02:32Z")
Hi, I am new to the Zeek Network Security Monitor. I am currently trying to configure the Prometheus Exporter for Zeek. Could you please share a GitHub URL from where I can download the Prometheus Exporter for Zeek to c… --- ## [Zeek file extract, redef FileExtract::prefix](https://community.zeek.org/t/zeek-file-extract-redef-fileextract-prefix/7785)
**Author:** [@w2k8](https://community.zeek.org/u/w2k8)\ **Replies:** 2\ **Last updated:** [May 28, 2025, 12:37pm UTC](https://community.zeek.org/t/zeek-file-extract-redef-fileextract-prefix/7785 "2025-05-28T12:37:23Z")
Hi, I have a question: I want to extract files from the network stream. In the local.zeek i have added a line: redef FileExtract::prefix"/data/extract\_files/"; @load customscript I have added a CustomFileExtraction… --- ## [Packet filtering examples](https://community.zeek.org/t/packet-filtering-examples/7782)
**Author:** [@markfen](https://community.zeek.org/u/markfen)\ **Replies:** 0\ **Last updated:** [May 17, 2025, 12:02am UTC](https://community.zeek.org/t/packet-filtering-examples/7782 "2025-05-17T00:02:42Z")
I’m trying to filter out a load of port scans which are totally killing zeek. I have a filter rules something like this in a file loaded from site.zeek: redef restrict\_filters += { \[“not-one-host”\] = “not host 10.92.16… --- ## [Added Fields Ordering](https://community.zeek.org/t/added-fields-ordering/7778)
**Author:** [@ephemeric](https://community.zeek.org/u/ephemeric)\ **Replies:** 2\ **Last updated:** [May 15, 2025, 6:31pm UTC](https://community.zeek.org/t/added-fields-ordering/7778 "2025-05-15T18:31:14Z")
Hi, Am I correct in stating that field order is not to be relied on for log parsing? As per #718: Log protocol type for notices - #3 one should/must avoid relying on the order of fields. If I install GitHub - cisagov/… --- ## [Suggest me for a demo about zeek](https://community.zeek.org/t/suggest-me-for-a-demo-about-zeek/7748)
**Author:** [@ducanh](https://community.zeek.org/u/ducanh)\ **Replies:** 1\ **Last updated:** [May 15, 2025, 10:50am UTC](https://community.zeek.org/t/suggest-me-for-a-demo-about-zeek/7748 "2025-05-15T10:50:11Z")
Hi guys, I’m new zeek learner, I need a project of zeek scripting but I’m not see much example about this can anyone suggest me, and what’s I need to learn to get that. please help me :(((( --- ## [How to query installed packet filter](https://community.zeek.org/t/how-to-query-installed-packet-filter/7751)
**Author:** [@markfen](https://community.zeek.org/u/markfen)\ **Replies:** 0\ **Last updated:** [April 20, 2025, 6:38pm UTC](https://community.zeek.org/t/how-to-query-installed-packet-filter/7751 "2025-04-20T18:38:11Z")
Hello, I’m attempting to use restrict\_filters to delete a bunch of network noise before Zeek attempts to process it. I’m not getting any errors and it appears to be working, but I’d like to see what the actual compiled… --- ## [Unknown protocol handling in zeek](https://community.zeek.org/t/unknown-protocol-handling-in-zeek/7746)
**Author:** [@biswa61](https://community.zeek.org/u/biswa61)\ **Replies:** 3\ **Last updated:** [April 15, 2025, 2:51pm UTC](https://community.zeek.org/t/unknown-protocol-handling-in-zeek/7746 "2025-04-15T14:51:07Z")
Hi, I am trying to print unknown protocol w.r.t zeek protocol analyzer in my script. So, I searched for similar feature in zeek and saw unknown\_protocol() event is there. I am using zeek 6.1.1, that event was there. So,… --- ## [SSH - brute forcing](https://community.zeek.org/t/ssh-brute-forcing/7735)
**Author:** [@georgio](https://community.zeek.org/u/georgio)\ **Replies:** 1\ **Last updated:** [April 9, 2025, 5:45am UTC](https://community.zeek.org/t/ssh-brute-forcing/7735 "2025-04-09T05:45:07Z")
Hey there I am wondering if someone implemented Login\_By\_Password\_Guesser from the default ssh-bruteforcing since the script is not complete. Thank you --- ## [Bro-simple-scan test\_port\_scan.zeek Failing](https://community.zeek.org/t/bro-simple-scan-test-port-scan-zeek-failing/7743)
**Author:** [@ephemeric](https://community.zeek.org/u/ephemeric)\ **Replies:** 1\ **Last updated:** [April 7, 2025, 8:27am UTC](https://community.zeek.org/t/bro-simple-scan-test-port-scan-zeek-failing/7743 "2025-04-07T08:27:09Z")
Hi, Running: zeek-7.0.5 almalinux-9.5 bro-simple-scan-3e7802f The package test tests/test\_port\_scan.zeek fails as no notice.log is created. I only saw this now when posting that there is a PR Fix failing btest with Z… --- ## [Which have your challenges been with Zeek so far?](https://community.zeek.org/t/which-have-your-challenges-been-with-zeek-so-far/7375)
**Author:** [@chv](https://community.zeek.org/u/chv)\ **Replies:** 1\ **Last updated:** [April 7, 2025, 8:05am UTC](https://community.zeek.org/t/which-have-your-challenges-been-with-zeek-so-far/7375 "2025-04-07T08:05:15Z")
Hello Zeek Community, I’m looking for insights on improving Zeek IDS management. Could you please share your thoughts on the following: What challenges do you face with Zeek IDS management (initial setup, maintenance … --- ## [Zeek 7.1 - zeek.dpd (/src/zeek/src/analyzer/protocol/ldap/ans1.spicy:\) Data is missing](https://community.zeek.org/t/zeek-7-1-zeek-dpd-src-zeek-src-analyzer-protocol-ldap-ans1-spicy-value-data-is-missing/7730)
**Author:** [@w2k8](https://community.zeek.org/u/w2k8)\ **Replies:** 6\ **Last updated:** [March 19, 2025, 1:42pm UTC](https://community.zeek.org/t/zeek-7-1-zeek-dpd-src-zeek-src-analyzer-protocol-ldap-ans1-spicy-value-data-is-missing/7730 "2025-03-19T13:42:20Z")
Hi, I am testing zeek 7.1 when i compare the output of zeek 6.2 and zeek 7.1 i see parsing errors in dpd.log The error in dpd.log is: ./dpd.log:{“ts”:“2025-03-17T00:00:00.000000Z”,…,“id.resp\_p”:389,“proto”:“tcp”,“ana… --- ## [Need some help for TLS decryption failure](https://community.zeek.org/t/need-some-help-for-tls-decryption-failure/7728)
**Author:** [@liuchuang](https://community.zeek.org/u/liuchuang)\ **Replies:** 3\ **Last updated:** [March 18, 2025, 12:17pm UTC](https://community.zeek.org/t/need-some-help-for-tls-decryption-failure/7728 "2025-03-18T12:17:41Z")
Hi, I’m try TLS decryption failures, and based on the btest code, I suspect it’s related to the macro definition # @TEST-REQUIRES: grep -q "#define OPENSSL\_HAVE\_KDF\_H" $BUILD/zeek-config.h. In my zeek-config.h file, th… --- ## [How to encode id.orig\_h and id.resp\_h in log or have any way to hide it](https://community.zeek.org/t/how-to-encode-id-orig-h-and-id-resp-h-in-log-or-have-any-way-to-hide-it/7723)
**Author:** [@trong](https://community.zeek.org/u/trong)\ **Replies:** 6\ **Last updated:** [March 14, 2025, 4:40pm UTC](https://community.zeek.org/t/how-to-encode-id-orig-h-and-id-resp-h-in-log-or-have-any-way-to-hide-it/7723 "2025-03-14T16:40:09Z")
Hi all, I wondering that if id.orig\_h and id.resp\_h can be encoded Thank you everyone for your interest --- ## [Scan::Address\_Scan & Scan::Port\_Scan](https://community.zeek.org/t/scan-address-scan-scan-port-scan/7720)
**Author:** [@simba](https://community.zeek.org/u/simba)\ **Replies:** 1\ **Last updated:** [March 5, 2025, 6:34pm UTC](https://community.zeek.org/t/scan-address-scan-scan-port-scan/7720 "2025-03-05T18:34:50Z")
Since upgrading to Zeek version 6.2.1, I am no longer seeing address and port scan events in Zeek. I am able to see other ‘note’ but not these two. Do I have to manually import the scan.zeek file again? [Previous page](https://community.zeek.org/c/zeek/6.md) [Next page](https://community.zeek.org/c/zeek/6.md?page=2)