This blog post provides a step-by-step guide on how to install the zkg package manager for Zeek, including resolving external module dependencies and common errors encountered during the installation process.
Read More »Resolving Dependencies and Common Errors of Installing the zkg Package Manager for Zeek
Zeek provides the packet-filter framework to allow filtering out network packets by BPF expressions.
There are quite a few examples online, for example 1 and 2, to demonstrate the capability. However, most examples show only ipv4 addresses.
What happen if tries to filter ipv6 addresses?
最新Zeek LTS 4.0.0版本默认包含一个检测SSH暴力破解的脚本，本文是对该脚本代码的分析。
本文根据对Zeek的POP3 API的测试结果，初步归纳了一个pattern，编写Zeek脚本，输出POP3的解析日志。
Zeek（原名Bro）是一款历史悠久的开源网络协议解析软件，最早由Vern Paxson于95年设计实现1，目前被广泛应用在各种网络、安全软件中。
Zeek的核心功能是解析各种网络协议，并将解析内容写入log日志。当前Zeek lts 4.0.0版本没有提供默认的POP3协议解析脚本，本文讨论如何使用Zeek解析POP3协议。