zeek / zeek-aux

Zeek Auxiliary Programs

Zeek Auxiliary Programs

Contents

• Installation
• adtrace
• zeek-cut
• devel-tools
• rst

Version:	0.50-13

Handy auxiliary programs related to the use of the Zeek Network Security Monitor (https://www.zeek.org).

Installation

Installation is simple and standard:

./configure
make
make install

adtrace

The "adtrace" utility is used to compute the network address that compose the internal and extern nets that Zeek is monitoring. This program just reads a pcap (tcpdump) file and writes out the src MAC, dst MAC, src IP, dst IP for each packet seen in the file.

zeek-cut

The "zeek-cut" utility reads ASCII Zeek logs on standard input and outputs them to standard output with only the specified columns (the column names can be found in each log file in the "#fields" header line). If no column names are specified, then "zeek-cut" simply outputs all columns.

There are several command-line options available to modify the output (run "zeek-cut -h" to see a list of all options). There are options to convert timestamps into human-readable format, and options to specify whether or not to include the format header lines in the output (by default, they're not included).

For example, the following command will output the three specified columns from conn.log with the timestamps from the "ts" column being converted to human-readable format:

cat conn.log | zeek-cut -d ts id.orig_h id.orig_p

The specified order of the column names determines the output order of the columns (i.e., "zeek-cut" can reorder the columns).

The "zeek-cut" utility can read the concatenation of one or more uncompressed ASCII log files (however, JSON format is not supported) produced by Zeek version 2.0 or newer, as long as each log file contains format header lines (these are the lines at the beginning of the file starting with "#"). In fact, "zeek-cut" can process the concatenation of multiple ASCII log files that have different column layouts.

To read a compressed log file, a tool such as "zcat" must be used to uncompress the file. For example, "zeek-cut" can read a group of compressed conn.log files with a command like this:

zcat conn.*.log.gz | zeek-cut

devel-tools

A set of scripts used commonly for Zeek development. Note that none of these scripts are installed by 'make install'.

extract-conn-by-uid

Extracts a connection from a trace file based on its UID found in Zeek's conn.log

gen-mozilla-ca-list.rb

Generates list of Mozilla SSL root certificates in a format readable by Zeek.

update-changes

A script to maintain the CHANGES and VERSION files.

git-show-fastpath

Show commits to the fastpath branch not yet merged into master.

cpu-bench-with-trace

Run a number of Zeek benchmarks on a trace file.

rst

The "rst" utility can be invoked by a Zeek script to terminate an established TCP connection by forging RST tear-down packets.

zeek-aux's Issues

Cmake error on plugin creation --Configuration error

Hi ,
I was created a test plugin using init-plugin script ( based on the following documentation https://docs.zeek.org/en/stable/devel/plugins.html) , but following error's occurred on compilation time , any help would be really appreciated.
Platform:
I was cloned latest ZEEK , ZEEK-bifcl, zeek-aux script ( all repository cloned Recursively )
Os :Centos 7 / Repositories/SCL enabled for GCC version 7 .........

Commands :
./configure --enable-debug --with-bifcl=/opt/dev/zeek_plugins/bifcl/ --zeek-dist=/opt/dev/zeek1

Build Directory : build
Zeek Source Directory : /opt/dev/zeek1
-- The C compiler identification is GNU 7.3.1
-- The CXX compiler identification is GNU 7.3.1
-- Check for working C compiler: /opt/rh/devtoolset-7/root/usr/bin/cc
-- Check for working C compiler: /opt/rh/devtoolset-7/root/usr/bin/cc -- works
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Detecting C compile features
-- Detecting C compile features - done
-- Check for working CXX compiler: /opt/rh/devtoolset-7/root/usr/bin/c++
-- Check for working CXX compiler: /opt/rh/devtoolset-7/root/usr/bin/c++ -- works
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Detecting CXX compile features
-- Detecting CXX compile features - done
-- Performing Test cxx17_works
-- Performing Test cxx17_works - Success
-- Zeek executable :
-- Zeek source : /opt/dev/zeek1
-- Zeek build : /opt/dev/zeek1/build
-- Zeek install prefix : /usr/local/zeek
-- Zeek plugin directory: /usr/local/zeek/lib/zeek/plugins
-- Zeek debug mode : true
-- Configuring done
-- Generating done
CMake Warning:
Manually-specified variables were not used by the project:
ZEEK_DIST

---

after the make command

[Makefile:12: build-it] Error 1 (ignored)
( cd build && make )
make[1]: Entering directory '/opt/test/rot13-plugin/build'
make[2]: Entering directory '/opt/test/rot13-plugin/build'
make[3]: Entering directory '/opt/test/rot13-plugin/build'
Scanning dependencies of target bif-plugin-Demo_Rot13-rot13.bif
make[3]: Leaving directory '/opt/test/rot13-plugin/build'
make[3]: Entering directory '/opt/test/rot13-plugin/build'
[ 11%] [BIFCL] Processing src/rot13.bif
/bin/sh: /opt/dev/zeek_plugins/bifcl: Is a directory
make[3]: *** [CMakeFiles/bif-plugin-Demo_Rot13-rot13.bif.dir/build.make:65: rot13.bif.h] Error 1
make[3]: Leaving directory '/opt/test/rot13-plugin/build'
make[2]: *** [CMakeFiles/Makefile2:146: CMakeFiles/bif-plugin-Demo_Rot13-rot13.bif.dir/all] Error 2
make[2]: Leaving directory '/opt/test/rot13-plugin/build'
make[1]: *** [Makefile:152: all] Error 2
make[1]: Leaving directory '/opt/test/rot13-plugin/build'
make: *** [Makefile:13: build-it] Error 2

Migrate the CT log list dependency from v1 to v3

The latest CT log list URL is https://www.gstatic.com/ct/log_list/v3/log_list.json.

zeek-aux/devel-tools/gen-ct-list.pl

Line 14 in ce360d1

my $google_log_url = "https://www.gstatic.com/ct/log_list/log_list.json";

Reference: https://github.com/google/certificate-transparency-community-site/blob/master/docs/google/known-logs.md

Configuration error:Unknown CMake command "FindRequiredPackage"

1. Cloned this repo on ubuntu 18.04
2. Installed cmake using apt
3. ./configure gives following error :

Build Directory : build
Source Directory: /home/user/works/zeek-aux
-- The C compiler identification is GNU 7.3.0
-- The CXX compiler identification is GNU 7.3.0
-- Check for working C compiler: /usr/bin/cc
-- Check for working C compiler: /usr/bin/cc -- works
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Detecting C compile features
-- Detecting C compile features - done
-- Check for working CXX compiler: /usr/bin/c++
-- Check for working CXX compiler: /usr/bin/c++ -- works
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Detecting CXX compile features
-- Detecting CXX compile features - done
CMake Error at CMakeLists.txt:3 (include):
  include could not find load file:

    cmake/CommonCMakeConfig.cmake


CMake Error at CMakeLists.txt:8 (include):
  include could not find load file:

    FindRequiredPackage


CMake Error at CMakeLists.txt:10 (FindRequiredPackage):
  Unknown CMake command "FindRequiredPackage".


-- Configuring incomplete, errors occurred!
See also "/home/user/works/zeek-aux/build/CMakeFiles/CMakeOutput.log".

zeek-aux man page does not include -m, -M options

zeek-cut.1 does not include the -m and -M options in zeek-cut. The top of the file notes that it's generated by help2man , but it appears this may not have been run after the the addition of -m and -M to zeek-cut.c (in PR15 in August of 2020).
Here are the needed lines:

.TP
\fB-m\fR
Include the first format header block in the output in minimal view.
.TP
\fB-M\fR
Include all format header blocks in the output in minimal view.