ZEEK(8)

NAME
zeek - passive network traffic analyzer

SYNOPSIS
zeek [options] [file ...]

DESCRIPTION
Zeek is primarily a security monitor that inspects all traffic on a link in depth for signs of suspicious activity. More generally, however, Zeek supports a wide range of traffic analysis tasks even outside of the security domain, including performance measurements and helping with trouble-shooting. Zeek comes with built-in functionality for a range of analysis and detection tasks, including detecting malware by interfacing to external registries, reporting vulnerable versions of software seen on the network, identifying popular web applications, detecting SSH brute-forcing, validating SSL certificate chains, among others.

OPTIONS

<file>
    policy file, or read stdin

-a, --parse-only
    exit immediately after parsing scripts

-b, --bare-mode
    don't load scripts from the base/ directory

-d, --debug-policy
    activate policy file debugging

-e, --exec <zeek code>
    augment loaded policies by given code

-f, --filter <filter>
    tcpdump filter

-h, --help|-?
    command line help

-i, --iface <interface>
    read from given interface

-p, --prefix <prefix>
    add given prefix to policy file resolution

-r, --readfile <readfile>
    read from given tcpdump file

-s, --rulefile <rulefile>
    read rules from given file

-t, --tracefile <tracefile>
    activate execution tracing

-w, --writefile <writefile>
    write to given tcpdump file

-v, --version
    print version and exit

-x, --print-state <file.bst>
    print contents of state file

-C, --no-checksums
    ignore checksums

-F, --force-dns
    force DNS

-I, --print-id <ID name>
    print out given ID

-N, --print-plugins
    print available plugins and exit (-NN for verbose)

-P, --prime-dns
    prime DNS

-Q, --time
    print execution time summary to stderr

-R, --replay <events.bst>
    replay events

-S, --debug-rules
    enable rule debugging

-T, --re-level <level>
    set 'RE_level' for rules

-U, --status-file <file>
    Record process status in file

-W, --watchdog
    activate watchdog timer

-X, --zeekygen <cfgfile>
    generate documentation based on config file

--pseudo-realtime[=<speedup>]
    enable pseudo-realtime for performance evaluation (default 1)

--load-seeds <file>
    load seeds from given file

--save-seeds <file>
    save seeds to given file

The following option is available only when Zeek is built with the --enable-debug configure option:

-B, --debug <dbgstreams>
    Enable debugging output for selected streams ('-B help' for help)

The following options are available only when Zeek is built with gperftools support (use the --enable-perftools and --enable-perftools-debug configure options):

-m, --mem-leaks
    show leaks

-M, --mem-profile
    record heap

ENVIRONMENT

ZEEKPATH
    file search path

ZEEK_PLUGIN_PATH
    plugin search path

ZEEK_PLUGIN_ACTIVATE
    plugins to always activate

ZEEK_PREFIXES
    prefix list

ZEEK_DNS_FAKE
    disable DNS lookups

ZEEK_SEED_FILE
    file to load seeds from

ZEEK_LOG_SUFFIX
    ASCII log file extension

ZEEK_PROFILER_FILE
    Output file for script execution statistics

ZEEK_DISABLE_ZEEKYGEN
    Disable Zeekygen (Broxygen) documentation support

AUTHOR
zeek was written by The Zeek Project <info@zeek.org>.