Q: requirements for zeek running on pfSense router

Zeek
1

I am thinking about using the zeek package for pfsense to monitor all routed traffic, and knowingly ignoring all unrouted traffic that stays local to a collision domain.

The rationale is that I am interested in traffic crossing networks while not interested traffic staying confined in the VLAN where the traffic originates.

At the same time I am hoping that this brings down the ressource requirements for zeek to perform properly, since it doesn’t need to capture everything as it would need to do when connected to a span port.

Do we have people here with experience in running zeek in such a setup?

What is your estimate of what are the additional requirements for CPU cores, GBs of RAM and SSD storage on top of what pfSense is requiring for itself?

My setup would be pfSense router with 2x 1Gbps interfaces, 1 for the traffic to be routed and filtered, and 1 for managing the pfSense machine.

I am currently using a Qotom with:

  • CPU: i7 2C 4T
  • NIC: 6x 1GBps Intel
  • RAM: 4GB
  • Storage: 50GB SSD

Would there still be enough room to run zeek next to pfSense on this machine? If not, how many additional cores would I need, how much more RAM and SSD storage?

I understand that this also depends on the traffic mix and amount of traffic I have. This is just a home lab with lots of segregated VLANs - so there is clearly more traffic going through the router than you would see in a flat homelab network.

2

You may want to take a look at this:

Enjoy,

3

thanks I have seen that before. it is a different setup. I will try this instead: put the rpi to a port mirroring the trunk that the router sit on, so it sees the same as the router, and zeek load is offloaded from the router. I am rather sure that the rpi4b is not beefy enough for this. This is why I thought putting zeek on the i7 router would be better.

if someone still has the answer to my question, please step forward.

4

I run suricata, ntop and zeek on a pfsense box with an Atom C3758. CPU is less than 10%. Uses about 5.7GB of RAM. I have mirrored SSDs. Depending on your log storage 50G is lots. I run wazuh on this box as well and ship all the logs to the wazuh manager.

5

thanks, you are actually the first person who does this an answers my question and I have asked in many places. good to know!

In the meanwhile I set up a RPi4b with zeek as a PoC. It also works reasonably well.