tollan/zeek repository overview

# SSH access
ssh root@<container_ip>
# Password: pass

# Or use GNS3 console

# Apply sysctl settings
sysctl -p

# Start logging service
rsyslogd

# Start SSH service
service ssh start

# Start Zeek
zeekctl start

# Check if Zeek is running
ps aux | grep zeek

# Check Zeek version
zeek --version

# Check ZeekControl status
zeekctl status

# Node configuration
[zeek]
type=standalone
host=localhost
interface=eth0

# Logging configuration
[logger]
type=logger
host=localhost

[manager]
type=manager
host=localhost

[proxy]
type=proxy
host=localhost

# Edit Zeek configuration
vim /opt/zeek/etc/node.cfg

# Edit ZeekControl configuration
vim /opt/zeek/etc/zeekctl.cfg

# Test configuration
zeekctl check

# Deploy configuration
zeekctl deploy

# Start Zeek
zeekctl start

# Stop Zeek
zeekctl stop

# Restart Zeek
zeekctl restart

# Check status
zeekctl status

# Deploy configuration
zeekctl deploy

# Run Zeek on live traffic
zeek -i eth0

# Run Zeek on pcap file
zeek -r capture.pcap

# Run Zeek with specific scripts
zeek -i eth0 scripts/policy/misc/scan.zeek

# Run Zeek in daemon mode
zeek -i eth0 -d

# List available scripts
zeek -N

# Run specific script
zeek -i eth0 scripts/policy/misc/scan.zeek

# Run multiple scripts
zeek -i eth0 scripts/policy/misc/scan.zeek scripts/policy/protocols/conn/known-services.zeek

# Create custom script
vim /opt/zeek/share/zeek/site/local.zeek

# Example custom script
event connection_established(c: connection)
{
    print fmt("New connection: %s -> %s", c$id$orig_h, c$id$resp_h);
}

# View Zeek logs
tail -f /opt/zeek/logs/current/conn.log

# View specific log types
tail -f /opt/zeek/logs/current/http.log
tail -f /opt/zeek/logs/current/dns.log
tail -f /opt/zeek/logs/current/ssl.log

# View system logs
tail -f /var/log/syslog | grep zeek

# Monitor network traffic
tcpdump -i any -w capture.pcap

# Analyze with Zeek
zeek -r capture.pcap

# View analysis results
ls /opt/zeek/logs/current/

# From another container, generate traffic to test Zeek
ping <zeek_ip>
nmap -sS <zeek_ip>
curl http://<zeek_ip>

# Check if logs are being generated
ls -la /opt/zeek/logs/current/

# View connection logs
tail -f /opt/zeek/logs/current/conn.log

# View HTTP logs
tail -f /opt/zeek/logs/current/http.log