# offline analysis

**URL:** <https://community.zeek.org/t/offline-analysis/1395>\
**Category:** Zeek\
**Created:** [October 6, 2008, 8:12am UTC](https://community.zeek.org/t/offline-analysis/1395 "2008-10-06T08:12:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hossein\_talebi](https://avatars.discourse-cdn.com/v4/letter/h/f17d59/32.png) [@hossein\_talebi](https://community.zeek.org/u/hossein_talebi)\
**Post date:** [October 6, 2008, 8:12am UTC](https://community.zeek.org/t/offline-analysis/1395/1 "2008-10-06T08:12:23Z")

</div>

how to perform offline analysis and view analysis statistic ?

---

<div class="post-metadata">

**Author:** ![jean-philippe\_luiggi](https://avatars.discourse-cdn.com/v4/letter/j/8e7dd6/32.png) [@jean-philippe\_luiggi](https://community.zeek.org/u/jean-philippe_luiggi)\
**Post date:** [October 7, 2008, 1:52am UTC](https://community.zeek.org/t/offline-analysis/1395/2 "2008-10-07T01:52:03Z")

</div>

Hello Hossein,

First idea, capture the network packets using something likes "tcpdump  
-i ethx -w foo.cap", then use "Bro" to read "foo.cap".

With regards,

Jean-Philippe.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/offline-analysis/1395/3 "2022-05-06T15:38:40Z")

</div>

Closed on May 6, 2022, 3:38pm UTC