Zeek is a network traffic analyser that, instead of raising an alarm on every suspicious packet, keeps a methodical record of everything that crosses a link. Until 2018 it was called Bro. Vern Paxson, then a researcher at Lawrence Berkeley National Laboratory, wrote the first version in 1995, and the paper describing it won the best paper award at the 1998 USENIX Security Symposium, according to the history page in the documentation.
The code is released under the three-clause BSD licence. The project is run by its community and a volunteer leadership team, while Corelight describes itself as the project’s custodian rather than its owner and funds part of the work. Version 9.0.0, published on GitHub on 21 August 2026, is presented on zeek.org as the current long-term support release.
What Zeek is for
Zeek listens to a copy of the traffic, taken from a switch mirror port or a network tap, and rebuilds the conversations layer by layer. The result is a set of separate logs per protocol: one file listing every connection, others for DNS queries, HTTP exchanges, TLS certificates, transferred files, SSH or SMB sessions. Written as tab-separated text or JSON, these logs are compact next to a full packet capture and slot easily into a SIEM or a search platform.
All of Zeek’s behaviour, default logging included, is written in its own scripting language. An analyst can therefore add detection logic tailored to a particular network, carve files out of a session automatically, spot SSH brute-force attempts or flag a certificate whose chain of trust fails to validate. A package manager, created in 2016 with a grant from the Mozilla Foundation, installs community-written extensions. For heavy traffic, several machines share the load as a cluster, and the documentation mentions sites monitoring 10 and then 100 Gbit/s links.
The documentation is candid about what Zeek is not. It does not block or alter packets, and for an inline prevention system it points to Suricata or Snort. It is not built for byte-level signature matching either, which is where Suricata shines, nor for frame-by-frame inspection in the manner of Wireshark. Next to Wazuh, which watches hosts through agents, Zeek supplies the network view, and ntopng, already in our software library, is better suited to tracking volumes and performance.
Who is it for?
Zeek targets security teams that need a reliable history of what happened on the network, both for threat hunting and for post-incident investigation. The documentation lists universities, research labs, supercomputing centres, large corporations and government agencies among its regular users. Researchers also value it as a programmable framework for studying protocols.
It does demand real commitment. You need a listening point on the network, hardware sized for the traffic volume, and time to learn a dedicated scripting language before going beyond the default logs. There is no graphical interface, so logs are read on the command line or shipped to a visualisation tool. An organisation that mainly wants to stop known attacks should look at Suricata, and one that wants to monitor its servers from the inside at Wazuh.
Download Zeek safely
The Get Zeek page on zeek.org gathers the source tarballs, hosted on download.zeek.org, and links to Linux binary packages built on the openSUSE Build Service, with separate channels for the latest release, the long-term support lines and release candidates. The project also publishes official Docker images as zeek/zeek, tagged latest and lts. On macOS, FreeBSD and OpenBSD, Zeek installs through Homebrew or the ports collections, which the documentation notes are not maintained by the project. For Windows only an experimental build from source is described.
There is no paid edition of Zeek. Corelight sells its own sensors built around it, but the software released by the project is complete and free. Because a Zeek sensor sees all of an organisation’s traffic, including cleartext passwords and sensitive data, any build obtained outside the project’s channels is an unacceptable risk.
Frequently asked questions
What is the difference between Bro and Zeek?
They are the same software. The leadership team decided to rename it in autumn 2018, and Zeek 3.0, released in 2019, was the first version under the new name.
Can Zeek block an attack?
No. Zeek is passive and works on a copy of the traffic. It can call a firewall or switch from a script, but for inline blocking the documentation recommends Suricata or Snort in prevention mode.
Does Zeek run on Windows?
Not officially. The project documents an experimental build with Visual Studio and Npcap, with no ready-made binary. Linux remains the reference platform, with official packages and Docker images.
