4 ms·

Zeek is a network protocol parser used to monitor network activity. It parses protocols such as SMTP, DNS, TLS, HTTP, FTP, File, SSH, etc. and collects metadata

by amony 4y ago

Zeek is a network protocol parser used to monitor network activity. It parses protocols such as SMTP, DNS, TLS, HTTP, FTP, File, SSH, etc. and collects metadata about that activity. Here's some of the DNS fields it extracts as it observes the traffic: https://docs.zeek.org/en/current/scripts/base/protocols/dns/main.zeek.html https://docs.zeek.org/en/current/scripts/base/protocols/dns/...

ape4 4y ago
Does it decrypt TLS?
- amony 4y ago
  No. It parses that protocol and logs the metadata observed (time, duration, bytes, source IP, destination IP, ports, cert info, etc.) Edit: I suppose it could be configured to do that. I've used Zeek in several organizations over the last 15 years and I have never seen it used in that way. However, Zeek running on a client computer (not on a cluster being fed from a 100 Gbit tap or SPAN) would be more scalable. And this announcement is about that. Here's a nice paper on how Zeek has been configured to monitor fast networks: https://commons.lbl.gov/download/attachments/120063098/100GIntrusionDetection.pdf https://commons.lbl.gov/download/attachments/120063098/100GI...
- dvt 4y ago
  If you have the keys, it looks like it can[1][2] (a contingency is that connections must use `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`) -- it seems like it's basically the same thing as Wireshark (a network packet sniffer for debugging/forensic purposes). Not sure why everyone on HN is freaking out about it. It's actually pretty annoying to have to install Wireshark (including their capture driver) every time I need to debug over-the-wire network data. [1] https://docs.zeek.org/en/current/scripts/policy/protocols/ssl/decryption.zeek.html https://docs.zeek.org/en/current/scripts/policy/protocols/ss... [2] https://docs.zeek.org/en/current/scripts/base/bif/plugins/Zeek_SSL.functions.bif.zeek.html https://docs.zeek.org/en/current/scripts/base/bif/plugins/Ze...

by amony 4y ago

ape4 4y ago

Does it decrypt TLS?

amony 4y ago
No. It parses that protocol and logs the metadata observed (time, duration, bytes, source IP, destination IP, ports, cert info, etc.) Edit: I suppose it could be configured to do that. I've used Zeek in several organizations over the last 15 years and I have never seen it used in that way. However, Zeek running on a client computer (not on a cluster being fed from a 100 Gbit tap or SPAN) would be more scalable. And this announcement is about that. Here's a nice paper on how Zeek has been configured to monitor fast networks: https://commons.lbl.gov/download/attachments/120063098/100GIntrusionDetection.pdf https://commons.lbl.gov/download/attachments/120063098/100GI...
dvt 4y ago
If you have the keys, it looks like it can[1][2] (a contingency is that connections must use `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`) -- it seems like it's basically the same thing as Wireshark (a network packet sniffer for debugging/forensic purposes). Not sure why everyone on HN is freaking out about it. It's actually pretty annoying to have to install Wireshark (including their capture driver) every time I need to debug over-the-wire network data. [1] https://docs.zeek.org/en/current/scripts/policy/protocols/ssl/decryption.zeek.html https://docs.zeek.org/en/current/scripts/policy/protocols/ss... [2] https://docs.zeek.org/en/current/scripts/base/bif/plugins/Zeek_SSL.functions.bif.zeek.html https://docs.zeek.org/en/current/scripts/base/bif/plugins/Ze...