a passive, open-source network traffic analyzer. It is primarily a security monitor that inspects all traffic on a link in depth for signs of suspicious activity. More generally, however, Zeek supports a wide range of traffic analysis tasks even outside of the security domain, including performance measurements and helping with trouble-shooting.
It also apparently was called "Bro" before changing its name to "Zeek".
I found this tool in the process of researching public suffixes. It is used to implement a program that checks whether a DNS query should be trusted or not, on the basis of whether it's a "trusted subdomain".
1 comment
[ 1.1 ms ] story [ 13.3 ms ] threadIts homepage (main link) is a bit opaque. But in the documentation page (https://docs.zeek.org/en/master/intro/index.html), it describes itself as:
a passive, open-source network traffic analyzer. It is primarily a security monitor that inspects all traffic on a link in depth for signs of suspicious activity. More generally, however, Zeek supports a wide range of traffic analysis tasks even outside of the security domain, including performance measurements and helping with trouble-shooting.
It also apparently was called "Bro" before changing its name to "Zeek".
I found this tool in the process of researching public suffixes. It is used to implement a program that checks whether a DNS query should be trusted or not, on the basis of whether it's a "trusted subdomain".
The Zeek implementation itself is here, which is mostly just straightforward regex manipulations and if/else checks: https://github.com/corelight/icannTLD/blob/master/scripts/ma....