# \#development **URL:** https://community.zeek.org/tag/development/2.md [Latest](https://community.zeek.org/latest.md) · [Categories](https://community.zeek.org/categories.md) · [Tags](https://community.zeek.org/tags.md) --- ## [Hitting Error Dictionary insertion distance too far: 65535](https://community.zeek.org/t/hitting-error-dictionary-insertion-distance-too-far-65535/7978)
**Author:** [@rachit](https://community.zeek.org/u/rachit)\ **Replies:** 13\ **Last updated:** [August 24, 2026, 1:03pm UTC](https://community.zeek.org/t/hitting-error-dictionary-insertion-distance-too-far-65535/7978 "2026-08-24T13:03:15Z")
Hello everyone, I’m new to Zeek, and I’m trying to process large pcap files using zeek -r \. Currently, since my pcap file too large to process in one run, I’m using editcap to split them into manageable chunks tha… --- ## [Zeek 9.0 Development Update](https://community.zeek.org/t/zeek-9-0-development-update/8050)
**Author:** [@Christian](https://community.zeek.org/u/Christian)\ **Replies:** 0\ **Last updated:** [August 12, 2026, 8:21pm UTC](https://community.zeek.org/t/zeek-9-0-development-update/8050 "2026-08-12T20:21:03Z")
Zeek 9.0, our next long-term support (LTS) release, is just around the corner! Here’s a quick look at what’s been keeping us busy in the lead-up to the release, and what you can expect over the next few weeks. As always… --- ## [Zeek 8.2 Development Update](https://community.zeek.org/t/zeek-8-2-development-update/7966)
**Author:** [@Christian](https://community.zeek.org/u/Christian)\ **Replies:** 0\ **Last updated:** [April 16, 2026, 10:33pm UTC](https://community.zeek.org/t/zeek-8-2-development-update/7966 "2026-04-16T22:33:06Z")
The Zeek development team is closing in on Zeek 8.2, our final feature release in the 8.x cycle! This blog post provides a sneak peek at some of the new functionality and changes in that release. As always, this is an ex… --- ## [Zeek memory Limit](https://community.zeek.org/t/zeek-memory-limit/7936)
**Author:** [@trong](https://community.zeek.org/u/trong)\ **Replies:** 6\ **Last updated:** [January 22, 2026, 9:08am UTC](https://community.zeek.org/t/zeek-memory-limit/7936 "2026-01-22T09:08:48Z")
Hello everyone, I’m running Zeek 6.0.1 with the DPDK ESnet plugin. and trying to limit Zeek’s memory usage. I’m currently testing two approaches: Zeek’s Memlimit and setting memory limits via systemd (systemctl). But i… --- ## [Need Guidance on Enabling IMAP Attachment Extraction in Zeek](https://community.zeek.org/t/need-guidance-on-enabling-imap-attachment-extraction-in-zeek/7951)
**Author:** [@hareem2004](https://community.zeek.org/u/hareem2004)\ **Replies:** 1\ **Last updated:** [March 3, 2026, 3:47pm UTC](https://community.zeek.org/t/need-guidance-on-enabling-imap-attachment-extraction-in-zeek/7951 "2026-03-03T15:47:16Z")
Hello everyone, I am currently working on a solution that will use Zeek where we need to analyze email traffic at the protocol level and extract attachments. For other protocols like SMTP ,POP3 etc attachment extractio… --- ## [HTTP2 Analyzer Plugin](https://community.zeek.org/t/http2-analyzer-plugin/7937)
**Author:** [@georgio](https://community.zeek.org/u/georgio)\ **Replies:** 2\ **Last updated:** [January 23, 2026, 8:51am UTC](https://community.zeek.org/t/http2-analyzer-plugin/7937 "2026-01-23T08:51:53Z")
Hey there, I tried to install the HTTP2 analyzer GitHub - MITRECND/bro-http2: Plugin for Zeek/Bro which provides http2 decoder/analyzer But i get this error line 181: identifier not defined: http2\_stream\_stat The prob… --- ## [Zeek 8.1 Development Update](https://community.zeek.org/t/zeek-8-1-development-update/7920)
**Author:** [@michelle](https://community.zeek.org/u/michelle)\ **Replies:** 0\ **Last updated:** [December 16, 2025, 9:02pm UTC](https://community.zeek.org/t/zeek-8-1-development-update/7920 "2025-12-16T21:02:33Z")
The first release candidate for Zeek 8.1 is out! This release includes the last major building block in our multi-release effort to move Zeek’s cluster communication off of Broker. Work on this release began in August an… --- ## [Is there anyone maintain the Kafka plugin](https://community.zeek.org/t/is-there-anyone-maintain-the-kafka-plugin/7910)
**Author:** [@josen](https://community.zeek.org/u/josen)\ **Replies:** 4\ **Last updated:** [December 8, 2025, 1:05am UTC](https://community.zeek.org/t/is-there-anyone-maintain-the-kafka-plugin/7910 "2025-12-08T01:05:36Z")
I am using Zeek Kafka plugin (GitHub - SeisoLLC/zeek-kafka: A Zeek log writer plugin that publishes to Kafka. · GitHub) and following the document to install the plugin manually. But I encountered some issues when I dep… --- ## [Switching to ZeroMQ by default](https://community.zeek.org/t/switching-to-zeromq-by-default/7911)
**Author:** [@awelzel](https://community.zeek.org/u/awelzel)\ **Replies:** 0\ **Last updated:** [December 4, 2025, 11:26am UTC](https://community.zeek.org/t/switching-to-zeromq-by-default/7911 "2025-12-04T11:26:18Z")
Hello. We’ve just switched the default cluster backend for a Zeekctl managed cluster to ZeroMQ in the master branch. This means that if you’re deploying a Zeek cluster using Zeekctl, individual cluster nodes (workers, l… --- ## [Building zeek under yocto?](https://community.zeek.org/t/building-zeek-under-yocto/7898)
**Author:** [@enok](https://community.zeek.org/u/enok)\ **Replies:** 3\ **Last updated:** [November 11, 2025, 12:30pm UTC](https://community.zeek.org/t/building-zeek-under-yocto/7898 "2025-11-11T12:30:34Z")
Did anyone every build zeek for a yocto-linux target? Or did anyone cross-compile zeek for an embedded application with some other tool? Is zeek a good choice for a tiny single-core arm embedded Linux host? Many thanks … --- ## [How to use nested modules?](https://community.zeek.org/t/how-to-use-nested-modules/7882)
**Author:** [@Zeek\_Noob](https://community.zeek.org/u/Zeek_Noob)\ **Replies:** 1\ **Last updated:** [November 3, 2025, 8:06am UTC](https://community.zeek.org/t/how-to-use-nested-modules/7882 "2025-11-03T08:06:31Z")
Hey Community, I was playing around with Spicy and was wondering if it is possible to use nested modules. Something like: module protocol::types; with: import protocol\_types; variable: protocol::types::mytype; But… --- ## [Creating x509.log from Parsed x509 Bytestring](https://community.zeek.org/t/creating-x509-log-from-parsed-x509-bytestring/7881)
**Author:** [@Zeek\_Noob](https://community.zeek.org/u/Zeek_Noob)\ **Replies:** 0\ **Last updated:** [October 27, 2025, 11:57am UTC](https://community.zeek.org/t/creating-x509-log-from-parsed-x509-bytestring/7881 "2025-10-27T11:57:25Z")
Hey Community, I have a x509 Certificate from a Byte-string in a local variable. I want to save it as a file and create the corresponding entry in the x509.log. How do I accomplish that? Something like: local cert: st… --- ## [Zeek 7.2.1: issue with zeekctl when using ZeroMQ cluster backend](https://community.zeek.org/t/zeek-7-2-1-issue-with-zeekctl-when-using-zeromq-cluster-backend/7843)
**Author:** [@thiennt](https://community.zeek.org/u/thiennt)\ **Replies:** 6\ **Last updated:** [August 18, 2025, 9:14am UTC](https://community.zeek.org/t/zeek-7-2-1-issue-with-zeekctl-when-using-zeromq-cluster-backend/7843 "2025-08-18T09:14:33Z")
Hi, I’m testing Zeek 7.2.1 in Docker with the new ZeroMQ cluster backend enabled via: @load frameworks/cluster/backend/zeromq/connect Issue: command “zeekctl netstats” hangs indefinitely without returning any output o… --- ## [Zeek 8.0 Development Update](https://community.zeek.org/t/zeek-8-0-development-update/7851)
**Author:** [@Christian](https://community.zeek.org/u/Christian)\ **Replies:** 0\ **Last updated:** [July 28, 2025, 5:31pm UTC](https://community.zeek.org/t/zeek-8-0-development-update/7851 "2025-07-28T17:31:58Z")
Zeek 8.0, our next long-term support (LTS) release, is just a few weeks away! Time for a quick recap of what the development team has been up to lately, and a look at our planned release timeline. The major features we … --- ## [Zeek with tcpreplay](https://community.zeek.org/t/zeek-with-tcpreplay/7844)
**Author:** [@trong](https://community.zeek.org/u/trong)\ **Replies:** 4\ **Last updated:** [July 18, 2025, 9:07am UTC](https://community.zeek.org/t/zeek-with-tcpreplay/7844 "2025-07-18T09:07:24Z")
"Hi everyone, I’m using Zeek version 6.0.2-1.el9.x86\_64, and I’m trying to use tcpreplay in combination with Zeek. I’ve set up two machines on the same network: One machine runs tcpreplay with a .pcap file The other … --- ## [CPU pinning in zeek](https://community.zeek.org/t/cpu-pinning-in-zeek/7796)
**Author:** [@trong](https://community.zeek.org/u/trong)\ **Replies:** 5\ **Last updated:** [June 9, 2025, 2:47pm UTC](https://community.zeek.org/t/cpu-pinning-in-zeek/7796 "2025-06-09T14:47:43Z")
I’m currently using Zeek in clustering mode and discovered that the pin\_cpus option allows me to specify which CPU cores the worker nodes should run on. Here is my config \[zeek\] type = logger host = localhost \[manager\]… --- ## [Are Spicy parsers slower than Binpac parsers?](https://community.zeek.org/t/are-spicy-parsers-slower-than-binpac-parsers/7794)
**Author:** [@etyp](https://community.zeek.org/u/etyp)\ **Replies:** 1\ **Last updated:** [June 3, 2025, 6:41pm UTC](https://community.zeek.org/t/are-spicy-parsers-slower-than-binpac-parsers/7794 "2025-06-03T18:41:22Z")
Hi! I wrote on the Zeek blog about some of the performance investigations with Spicy parsers compared to Binpac parsers. Check it out if you’re curious about upcoming optimization work with Spicy :slight\_smile: --- ## [Creating a Baseline from known hosts and services](https://community.zeek.org/t/creating-a-baseline-from-known-hosts-and-services/7744)
**Author:** [@georgio](https://community.zeek.org/u/georgio)\ **Replies:** 2\ **Last updated:** [May 15, 2025, 2:19pm UTC](https://community.zeek.org/t/creating-a-baseline-from-known-hosts-and-services/7744 "2025-05-15T14:19:53Z")
Hey there, How do you find my idea since I couldn’t find so much info about creating a baseline. I know that are some logs ( known-hosts) which includes the IP’s from my network that completed a TCP handshake in 24 hou… --- ## [Suggest me for a demo about zeek](https://community.zeek.org/t/suggest-me-for-a-demo-about-zeek/7748)
**Author:** [@ducanh](https://community.zeek.org/u/ducanh)\ **Replies:** 1\ **Last updated:** [May 15, 2025, 10:50am UTC](https://community.zeek.org/t/suggest-me-for-a-demo-about-zeek/7748 "2025-05-15T10:50:11Z")
Hi guys, I’m new zeek learner, I need a project of zeek scripting but I’m not see much example about this can anyone suggest me, and what’s I need to learn to get that. please help me :(((( --- ## [Unknown protocol handling in zeek](https://community.zeek.org/t/unknown-protocol-handling-in-zeek/7746)
**Author:** [@biswa61](https://community.zeek.org/u/biswa61)\ **Replies:** 3\ **Last updated:** [April 15, 2025, 2:51pm UTC](https://community.zeek.org/t/unknown-protocol-handling-in-zeek/7746 "2025-04-15T14:51:07Z")
Hi, I am trying to print unknown protocol w.r.t zeek protocol analyzer in my script. So, I searched for similar feature in zeek and saw unknown\_protocol() event is there. I am using zeek 6.1.1, that event was there. So,… --- ## [SSH - brute forcing](https://community.zeek.org/t/ssh-brute-forcing/7735)
**Author:** [@georgio](https://community.zeek.org/u/georgio)\ **Replies:** 1\ **Last updated:** [April 9, 2025, 5:45am UTC](https://community.zeek.org/t/ssh-brute-forcing/7735 "2025-04-09T05:45:07Z")
Hey there I am wondering if someone implemented Login\_By\_Password\_Guesser from the default ssh-bruteforcing since the script is not complete. Thank you --- ## [Zeek Current Documentation Issue](https://community.zeek.org/t/zeek-current-documentation-issue/7736)
**Author:** [@ende](https://community.zeek.org/u/ende)\ **Replies:** 2\ **Last updated:** [April 1, 2025, 11:53pm UTC](https://community.zeek.org/t/zeek-current-documentation-issue/7736 "2025-04-01T23:53:19Z")
zeek version 7.1.1 Hey all, when going through the examples on 2. Communication — Broker User Manual it seems that the documentation references outdated versions of c++ needed to use std::variant as well as an incorrec… --- ## [Zeek 7.2 Development Update](https://community.zeek.org/t/zeek-7-2-development-update/7738)
**Author:** [@Christian](https://community.zeek.org/u/Christian)\ **Replies:** 0\ **Last updated:** [March 31, 2025, 5:44pm UTC](https://community.zeek.org/t/zeek-7-2-development-update/7738 "2025-03-31T17:44:45Z")
We’re three months into the Zeek 7.2 development cycle, so now is a good time to share an update about ongoing development and our planned timeline for the Zeek’s next feature release. We recently merged two of the bigg… --- ## [Need some help for TLS decryption failure](https://community.zeek.org/t/need-some-help-for-tls-decryption-failure/7728)
**Author:** [@liuchuang](https://community.zeek.org/u/liuchuang)\ **Replies:** 3\ **Last updated:** [March 18, 2025, 12:17pm UTC](https://community.zeek.org/t/need-some-help-for-tls-decryption-failure/7728 "2025-03-18T12:17:41Z")
Hi, I’m try TLS decryption failures, and based on the btest code, I suspect it’s related to the macro definition # @TEST-REQUIRES: grep -q "#define OPENSSL\_HAVE\_KDF\_H" $BUILD/zeek-config.h. In my zeek-config.h file, th… --- ## [Add/Ignore files extensions from hosom file-extraction module](https://community.zeek.org/t/add-ignore-files-extensions-from-hosom-file-extraction-module/7712)
**Author:** [@georgio](https://community.zeek.org/u/georgio)\ **Replies:** 1\ **Last updated:** [March 3, 2025, 12:39pm UTC](https://community.zeek.org/t/add-ignore-files-extensions-from-hosom-file-extraction-module/7712 "2025-03-03T12:39:28Z")
Hey hey I am trying to modify the file extraction module and to understand this module better… This module extracts multiple file types by default, where should I comment or change the configuration to ignore some file… --- ## [Creating 2 analyzer instances of the same type in spicy](https://community.zeek.org/t/creating-2-analyzer-instances-of-the-same-type-in-spicy/7703)
**Author:** [@AlexSamuelVlad](https://community.zeek.org/u/AlexSamuelVlad)\ **Replies:** 3\ **Last updated:** [February 20, 2025, 11:02am UTC](https://community.zeek.org/t/creating-2-analyzer-instances-of-the-same-type-in-spicy/7703 "2025-02-20T11:02:34Z")
Hi, I’m writing a protocol analyzer for a proprietary protocol in spicy. I want to perform the following actions: Skip over some bytes in the stream Then pass the stream to some zeek analyzer using zeek::protocol\_dat… --- ## [Script for malicious User agent list](https://community.zeek.org/t/script-for-malicious-user-agent-list/7705)
**Author:** [@georgio](https://community.zeek.org/u/georgio)\ **Replies:** 2\ **Last updated:** [February 14, 2025, 12:14pm UTC](https://community.zeek.org/t/script-for-malicious-user-agent-list/7705 "2025-02-14T12:14:25Z")
Hey there, I am currently trying to create a script in local.zeek that contains a list with malicious user agents and every time when one of these agents exists in http.log a weird or notice log will be generated Can s… --- ## [Writing a Custom Zeek Packet Analyzer Plugin for VXLAN](https://community.zeek.org/t/writing-a-custom-zeek-packet-analyzer-plugin-for-vxlan/7683)
**Author:** [@liuchuang](https://community.zeek.org/u/liuchuang)\ **Replies:** 2\ **Last updated:** [January 16, 2025, 9:43am UTC](https://community.zeek.org/t/writing-a-custom-zeek-packet-analyzer-plugin-for-vxlan/7683 "2025-01-16T09:43:10Z")
hi, zeeker: I am try to write a PacketAnalyzer plugin use init-plugin, it does the same work as the vxlan built-in plugin, but my zeek script(PacketAnalyzer::register\_for\_ports(PacketAnalyzer::ANALYZER\_UDP, PacketAnalyz… --- ## [Need some best practices about event tcp\_options](https://community.zeek.org/t/need-some-best-practices-about-event-tcp-options/7681)
**Author:** [@liuchuang](https://community.zeek.org/u/liuchuang)\ **Replies:** 1\ **Last updated:** [December 25, 2024, 11:49pm UTC](https://community.zeek.org/t/need-some-best-practices-about-event-tcp-options/7681 "2024-12-25T23:49:47Z")
hi, zeeker I need to get the data of TCP option (kind == 78) from TCP and write it into the conn log. (f5 inserts the real source IP address into a TCP option. aka TOA) the normal process is to use event tcp\_options to… --- ## [Is there any VIM highlight plugin for zeek scripts available](https://community.zeek.org/t/is-there-any-vim-highlight-plugin-for-zeek-scripts-available/7672)
**Author:** [@liuchuang](https://community.zeek.org/u/liuchuang)\ **Replies:** 1\ **Last updated:** [December 16, 2024, 7:02am UTC](https://community.zeek.org/t/is-there-any-vim-highlight-plugin-for-zeek-scripts-available/7672 "2024-12-16T07:02:08Z")
hi,is there any VIM highlight plugin for zeek scripts available？ [Next page](https://community.zeek.org/tag/development/2.md?match_all_tags=true&page=1&tags%5B%5D=development)