ZEEK(8) System Administration Utilities ZEEK(8)

# [NAME](#NAME)

zeek - passive network traffic analyzer

# [SYNOPSIS](#SYNOPSIS)

**zeek** \[*options*] \[*file* ...]

# [DESCRIPTION](#DESCRIPTION)

Zeek is primarily a security monitor that inspects all traffic on a link in depth for signs of suspicious activity. More generally, however, Zeek supports a wide range of traffic analysis tasks even outside of the security domain, including performance measurements and helping with trouble-shooting.

Zeek comes with built-in functionality for a range of analysis and detection tasks, including detecting malware by interfacing to external registries, reporting vulnerable versions of software seen on the network, identifying popular web applications, detecting SSH brute-forcing, validating SSL certificate chains, among others.

You must have the necessary permissions to access to the files or interfaces specified.

# [OPTIONS](#OPTIONS)

**<file>**

policy file, or read stdin

[**-a**, --parse-only](#a)

exit immediately after parsing scripts

[**-b**, --bare-mode](#b)

don't load scripts from the base/ directory

[**-d**, --debug-policy](#d)

activate policy file debugging

[**-e**, --exec <zeek code>](#e)

augment loaded policies by given code

[**-f**, --filter <filter>](#f)

tcpdump filter

[**-h**, --help|-?](#h)

command line help

[**-i**, --iface <interface>](#i)

read from given interface

[**-p**, --prefix <prefix>](#p)

add given prefix to policy file resolution

[**-r**, --readfile <readfile>](#r)

read from given tcpdump file

[**-s**, --rulefile <rulefile>](#s)

read rules from given file

[**-t**, --tracefile <tracefile>](#t)

activate execution tracing

[**-w**, --writefile <writefile>](#w)

write to given tcpdump file

[**-v**, --version](#v)

print version and exit

[**-x**, --print-state <file.bst>](#x)

print contents of state file

[**-C**, --no-checksums](#C)

When this option is set, Zeek ignores invalid packet checksums and does process the packets. Furthermore, if this option is set Zeek also processes IP packets with a zero total length field, which is typically caused by TCP (TCP Segment Offloading) on the NIC.

[**-F**, --force-dns](#F)

force DNS

[**-I**, --print-id <ID name>](#I)

print out given ID

[**-N**, --print-plugins](#N)

print available plugins and exit (**-NN** for verbose)

[**-P**, --prime-dns](#P)

prime DNS

[**-Q**, --time](#Q)

print execution time summary to stderr

[**-R**, --replay <events.bst>](#R)

replay events

[**-S**, --debug-rules](#S)

enable rule debugging

[**-T**, --re-level <level>](#T)

set 'RE\_level' for rules

[**-U**, --status-file <file>](#U)

Record process status in file

[**-W**, --watchdog](#W)

activate watchdog timer

[**-X**, --zeekygen <cfgfile>](#X)

generate documentation based on config file

[**--pseudo-realtime\[=**<speedup>\]](#pseudo)

enable pseudo-realtime for performance evaluation (default 1)

[**--load-seeds** <file>](#load)

load seeds from given file

[**--save-seeds** <file>](#save)

save seeds to given file

[The following option is available only when Zeek is built with the --enable-debug configure option:](#The)

[**-B**, --debug <dbgstreams>](#B)

Enable debugging output for selected streams ('-B help' for help)

[The following options are available only when Zeek is built with gperftools support (use the --enable-perftools and --enable-perftools-debug configure options):](#The~2)

[**-m**, --mem-leaks](#m)

show leaks

[**-M**, --mem-profile](#M)

record heap

# [ENVIRONMENT](#ENVIRONMENT)

[**ZEEKPATH**](#ZEEKPATH)

file search path

[**ZEEK\_PLUGIN\_PATH**](#ZEEK_PLUGIN_PATH)

plugin search path

[**ZEEK\_PLUGIN\_ACTIVATE**](#ZEEK_PLUGIN_ACTIVATE)

plugins to always activate

[**ZEEK\_PREFIXES**](#ZEEK_PREFIXES)

prefix list

[**ZEEK\_DNS\_FAKE**](#ZEEK_DNS_FAKE)

disable DNS lookups

[**ZEEK\_SEED\_FILE**](#ZEEK_SEED_FILE)

file to load seeds from

[**ZEEK\_LOG\_SUFFIX**](#ZEEK_LOG_SUFFIX)

ASCII log file extension

[**ZEEK\_PROFILER\_FILE**](#ZEEK_PROFILER_FILE)

Output file for script execution statistics

[**ZEEK\_DISABLE\_ZEEKYGEN**](#ZEEK_DISABLE_ZEEKYGEN)

Disable Zeekygen (Broxygen) documentation support

# [OUTPUT FORMAT](#OUTPUT_FORMAT)

Output is written in multiple files depending on configuration. The default location is the current directory.

The output written by Zeek can be formatted in multiple ways using the logging framework.

The default are files in human-readable (ASCII) format. The data is organized into columns (tab-delimited). The data can be processed using, e.g., the **zeek-cut** tool.

# [EXAMPLES](#EXAMPLES)

Read a capture file and generate the default logs:  
\# zeek -r test-capture.pcap

When running on live traffic, Zeek is usually started by running **zeekctl**. To configure Zeek with an initial configuration, install, and restart:  
\# zeekctl deploy

Note: the zeekctl configuration may need to be updated before first use. Especially the network interface used should be the correct one.

# [SEE ALSO](#SEE_ALSO)

[zeekctl(8)](/man/enterprise-packages/zeek/zeekctl.8) [zeek-cut(1)](/man/enterprise-packages/zeek/zeek-cut.1)

# [AUTHOR](#AUTHOR)

**zeek** was written by The Zeek Project <info@zeek.org>.

November 2014 zeek

---

Document: zeek(8) from zeek 9.0.0-r3 (Chainguard OS)