| Port details on branch 2022Q4 |
- zeek System for detecting network intruders in real-time
- 5.0.4 security
 =0       7.0.8_1Version of this port present on the latest quarterly branch. - Maintainer: leres@FreeBSD.org
- Port Added: 2022-11-09 04:48:06
- Last Update: 2022-11-24 20:25:24
- Commit Hash: 82daa20
- License: BSD3CLAUSE
- WWW:
- https://www.zeek.org/
- Description:
- Zeek (formerly known as Bro) is an open-source, Unix-based Network
Intrusion Detection System (NIDS) that passively monitors network
traffic and looks for suspicious activity. Zeek detects intrusions
by first parsing network traffic to extract its application-level
semantics and then executing event-oriented analyzers that compare
the activity with patterns deemed troublesome. Its analysis includes
detection of specific attacks (including those defined by signatures,
but also those defined in terms of events) and unusual activities
(e.g., certain hosts connecting to certain services, or patterns
of failed connection attempts).
Zeek is documented in the USENIX 1998 Security Conference proceedings
(as Bro).
  ¦  ¦  ¦  ¦ 
- Manual pages:
- FreshPorts has no man page information for this port.
- pkg-plist: as obtained via:
make generate-plist - Dependency lines:
-
- To install the port:
- cd /usr/ports/security/zeek/ && make install clean
- To add the package, run one of these commands:
- pkg install security/zeek
- pkg install zeek
NOTE: If this package has multiple flavors (see below), then use one of them instead of the name specified above.- PKGNAME: zeek
- Flavors: there is no flavor information for this port.
- distinfo:
- TIMESTAMP = 1669313502
SHA256 (zeek-5.0.4.tar.gz) = d01aa72864b1128513c0b3667148e765f83cd9f0befe9a751c51f0f19a8ba280
SIZE (zeek-5.0.4.tar.gz) = 42712052
Packages (timestamps in pop-ups are UTC):
- Dependencies
- NOTE: FreshPorts displays only information on required and default dependencies. Optional dependencies are not covered.
- Build dependencies:
-
- bison>=3.3 : devel/bison
- cmake>=3.15.0 : devel/cmake
- flex>=2.6 : textproc/flex
- swig>=4.0.2 : devel/swig
- ipsumdump : net/ipsumdump
- bash : shells/bash
- py39-sqlite3>0 : databases/py-sqlite3@py39
- bison : devel/bison
- cmake : devel/cmake-core
- ninja : devel/ninja
- python3.9 : lang/python39
- perl5>=5.32.r0<5.33 : lang/perl5.32
- Runtime dependencies:
-
- c-ares>=1.18.1 : dns/c-ares
- ipsumdump : net/ipsumdump
- cf : sysutils/lbl-cf
- hf : sysutils/lbl-hf
- bash : shells/bash
- py39-sqlite3>0 : databases/py-sqlite3@py39
- py39-zkg>=2.7.1 : security/py-zkg@py39
- python3.9 : lang/python39
- perl5>=5.32.r0<5.33 : lang/perl5.32
- Library dependencies:
-
- libcares.so : dns/c-ares
- libmaxminddb.so : net/libmaxminddb
- libintl.so : devel/gettext-runtime
- There are no ports dependent upon this port
Configuration Options:- ===> The following configuration options are available for zeek-5.0.4:
GEOIP2=on: Build with GeoIP2 (MaxMindDB) support
IPSUMDUMP=on: Enables traffic summaries
LBL_CF=on: Unix time to formated time/date filter support
LBL_HF=on: Address to hostname filter support
NETMAP=on: Native Netmap Packet IOSource for Zeek
PERFTOOLS=off: Use Perftools to improve memory & CPU usage
SPICY=on: Enable the Spicy parser generator
ZEEKCTL=on: ZeekControl support (implies IPSUMDUMP)
ZKG=on: Zeek package manager support
====> Options available for the single BUILD_TYPE: you have to select exactly one of them
DEBUG=off: Optimizations off, debug symbols/flags on
MINSIZEREL=off: Optimizations on, debug symbols/flags off
RELEASE=on: Optimizations on, debug symbols/flags off
RELWITHDEBINFO=off: Optimizations/debug symbols on, debug flags off
===> Use 'make config' to modify these settings
- Options name:
- security_zeek
- USES:
- bison cmake compiler:c++17-lang cpe gettext-runtime perl5 python shebangfix ssl
- pkg-message:
- For install:
- The rc.d script now honors the zeek_user rc.d variable. To run as
a user other than root (the default) you need to make a few changes.
For example to run as the user zeek, add this to /etc/rc.conf:
zeek_enable="YES"
zeek_user="zeek"
Add this to /etc/devfs.conf:
own bpf root:bpf
perm bpf 0660
And add zeek to the bpf group:
bpf:*:81:zeek
and restart the devfs service:
service devfs restart
or reboot.
If the interface defined in node.cfg is configured for NIC checksum
offloading (the default when this feature is supported by the
hardware) you will want to set ignore_checksums in site/local.zeek:
redef ignore_checksums = T;
- If removing:
- During deinstall of this package, the cfg files for zeekctl are not
deleted if you have edited them. Instead the software will create
a .sample file and the edited files will remain in place when you
upgrade. If you want to delete them, you have to remove the
/usr/local/etc directory manually.
You may also need to manually remove /usr/local/spool/state.db
- Master Sites:
|
As an Amazon Associate I earn from qualifying purchases.
