Lesson 4.9: Zeek connection logs
Zeek watches network traffic and writes one line per connection: who talked to whom, on which port and protocol, for how long, how many bytes each way, and how it ended. That's enough to find data theft, remote-control sessions, odd ports and internal scanning without looking at a single packet's content. In the lab you read a night's conn.log from Northwind's network sensor and find 20 GB leaving, an eight-hour session to an attacker's server, a connection on a classic attack-tool port, and a machine probing 120 internal hosts for file sharing.
17 min
You will learn to
- Explain what Zeek records
- Read conn.log fields
- Find large outbound transfers
- Find long-lived and unusual-port connections
- Recognise internal scanning from connection states
Key terms
- Zeek
- An open-source network monitor that turns traffic into structured logs: conn.log, dns.log, http.log, ssl.log, files.log and more.
- conn_state
- How a TCP connection went: SF normal, S0 no reply, REJ rejected, RSTO/RSTR reset, and others.
- Exfiltration
- Moving data out of the organisation without authorisation.
- Lateral movement
- An attacker spreading from one internal machine to others.
- Egress filtering
- Allowing outbound traffic only to needed destinations and ports.
← Cross-site scripting (XSS) · All lessons · Public-key cryptography and SSH keys →