01 · Product name
Zeek
Turn a pcap into protocol logs.
Published by The Zeek Project.
In short
Zeek is the open-source network monitor, formerly Bro. The download page on 18 Oct 2026 listed current LTS Zeek 9.0.0, dated September 14, 2026, and previous LTS 8.0.10, dated August 19, 2026. The binary this listing ran printed version 7.0.11. On the sample http2_follow_multistream.pcapng it wrote conn.log and ssl.log. The SSL row's server_name was www.mozilla.org, cipher TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, next protocol h2. The COPYING file is a BSD-style grant. A log line is the parser's record of a connection, not an identity.
Product pricing strategy
02
Free
zeek.org does not print a price for the LTS releases. The COPYING file permits redistribution under its BSD-style terms. There is no credit pack on the download page. The 7.0.11 binary was a package install, not a paid build. Training and support, if you buy them, are separate from that license. The homepage's deployment and package counts are not fees. Cite the download page for 9.0.0 and 8.0.10, and cite the version command for 7.0.11. The openSUSE package filename said 7.0.1, and that string is not a price either.
Utility and features
03
Zeek reads packets and writes structured logs. The command was zeek -C -r on the Wireshark sample, using /opt/zeek/bin/zeek. The version command printed 7.0.11. The package file name from the openSUSE repository was zeek-7.0-core_7.0.1-0, which does not match the version string the binary printed. Quote the binary. The download page's current LTS was 9.0.0 and the previous LTS was 8.0.10. This run was neither.
- Binary 7.0.11. zeek version printed 7.0.11. The download page listed LTS 9.0.0 and 8.0.10.
- ssl.log named the server. server_name www.mozilla.org, TLS 1.2, next protocol h2, on the sample file.
- conn.log one session. Service ssl, state SF, from 10.9.0.2:59246 to 104.16.40.2:443.
ssl.log contained a row with server_name www.mozilla.org, version TLSv12, and next protocol h2. conn.log contained a TCP row with service ssl, originator 10.9.0.2 port 59246, responder 104.16.40.2 port 443, and state SF. The homepage claims 70+ log files by default, 3,000+ network events, 10,000+ deployments, and 280+ packages. Those are the page's figures on 18 Oct 2026. This run produced the logs the sample triggered, including conn.log, ssl.log, files.log, x509.log, and ocsp.log. It did not exercise 70 logs. The COPYING file is the BSD-style license from the Zeek authors. The GitHub SPDX field is NOASSERTION.
- 1
Run zeek -C -r on a file you are allowed to read, then open ssl.log or conn.log.
- 2
Write the binary version next to the LTS version from the download page.
- 3
Treat server_name as a handshake field, and open the pcap in Wireshark if you need the frame.
Caveats
04
Three version numbers were visible the same day. LTS 9.0.0 and 8.0.10 are the download page. 7.0.11 is what ran. The deb filename said 7.0.1. Do not collapse them.
The SSL server name is the name in the handshake. The connection state SF means the parser saw a normal TCP close in its model. It does not mean the HTTP/2 request was understood, and this listing did not load a policy script beyond the default. The homepage's 70+ logs were not produced by this one file. The addresses belong to the sample. Zeek on a sensor watches a network. This listing read a file.
Screenshots
05
Potential use cases
06
- You want a protocol log instead of a packet list. On 18 Oct 2026 zeek version printed 7.0.11. zeek -C -r on the sample wrote ssl.log with server_name www.mozilla.org, TLS 1.2, cipher TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, and next protocol h2. conn.log showed service ssl, state SF, from 10.9.0.2 port 59246 to 104.16.40.2 port 443.
- A report says this run produced the homepage's 70 or more log files. The homepage claimed that, plus 3,000+ events and 280+ packages, on 18 Oct 2026. This file produced the logs the sample triggered, including conn.log, ssl.log, files.log, x509.log, and ocsp.log. Say that. Do not write 70.
- Three version strings are in the same day's notes. The download page listed LTS 9.0.0 from September 14, 2026, and previous LTS 8.0.10 from August 19, 2026. The binary printed 7.0.11. The package filename said 7.0.1. Quote the binary for the run. COPYING is a BSD-style grant. The SPDX field is NOASSERTION.
Hard cases
The case where the first result is easy to over-read.
The package filename replaces the binary
zeek version printed 7.0.11. The deb filename zeek-7.0-core_7.0.1-0 is the package name, not the version command. LTS 9.0.0 and 8.0.10 were on the download page and were not executed. server_name is a handshake field. State SF is the parser's TCP model, not a claim that the HTTP/2 request was read.
Practitioners using it
Posts on X from people describing a concrete use. The quote is the post. Likes and reposts are the counts saved with it, not a live total. A label marks a creator, a maintainer, a vendor, a partner, a data partner, or an investor.
Added a simple #zeek script to my post to detect #sigreg CVE-2020-1350. @zeekurity https://t.co/p0heM3Xm8c
Well, this is interesting. Zeek caught one of the devices on my home network reaching out via SCTP.
#LSPPDay25 Explored Zeek. Learned network security monitoring with logs for threat hunting & forensics. Crafted scripts to detect FTP brut-force & cleartext passwords, leveraged packages for geolocation & file extraction. @lftechnology #60DaysOfLearning2025 #LearningWithLeapfrog pic.twitter.com/3SRszhaePi
Network monitoring in K8s is critical for expanding @MITREattack TTP coverage. I will talk about an approach to elevate your threat hunting game by enriching Zeek logs with the right context and attribution to containers / pods. @StanKiefer @corelight_inc https://t.co/mN8SG1D7bI
Partner
In this video, we use our improved #CommunityID support to pivot between different data types: Use Case #1 #Suricata alert --> #Zeek logs --> #Sysmon logs Use Case #2 #Zeek log --> #Suricata alerts --> #Sysmon logs Use Case #3 #Sysmon log --> #Zeek logs --> #Suricata alerts
Questions
Is Zeek free?
The download page does not print a price. COPYING is a BSD-style license. The binary this listing ran printed version 7.0.11.
Which Zeek version should the note cite?
Cite 7.0.11 for this run. Cite 9.0.0 as the current LTS on the download page the same day, and 8.0.10 as the previous LTS. Do not merge them.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Zeek project site
https://zeek.org/Pricing
Get Zeek
https://zeek.org/get-zeek/