No. It parses that protocol and logs the metadata observed (time, duration, bytes, source IP, destination IP, ports, cert info, etc.) Edit: I suppose it could

No. It parses that protocol and logs the metadata observed (time, duration, bytes, source IP, destination IP, ports, cert info, etc.) Edit: I suppose it could be configured to do that. I've used Zeek in several organizations over the last 15 years and I have never seen it used in that way. However, Zeek running on a client computer (not on a cluster being fed from a 100 Gbit tap or SPAN) would be more scalable. And this announcement is about that. Here's a nice paper on how Zeek has been configured to monitor fast networks: https://commons.lbl.gov/download/attachments/120063098/100GIntrusionDetection.pdf https://commons.lbl.gov/download/attachments/120063098/100GI...