Cheat sheet

Zeek logs

Zeek turns network traffic into structured logs, one per protocol. The analysis approach is in Network Traffic Analysis.

CDSA CJCANetwork

The logs

File	Contents
conn.log	One line per connection: addresses, ports, protocol, duration, volumes
dns.log	DNS queries and answers
http.log	HTTP requests: method, host, URI, user agent, response code
ssl.log	TLS sessions: version, requested name (server_name), certificate
files.log	Files seen on the network, with their hashes
x509.log	Certificates observed
ssh.log	SSH connections and authentication result
smb_files.log	Files read or written over SMB
notice.log	Alerts raised by Zeek scripts
weird.log	Protocol anomalies

# Analyse a capture: one .log file per protocol in the current folder
zeek -C -r capture.pcap
# Pick columns
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p service duration orig_bytes
# Most contacted destinations
cat conn.log | zeek-cut id.resp_h | sort | uniq -c | sort -rn | head

conn.log fields

Field	Meaning
uid	Connection identifier, repeated in the other logs
id.orig_h	Originator address
id.orig_p	Originator port
id.resp_h	Responder address
id.resp_p	Responder port
proto	Transport protocol (tcp, udp, icmp)
service	Detected application protocol (http, dns, ssl…)
duration	Connection duration
orig_bytes	Bytes sent by the originator
resp_bytes	Bytes sent by the responder
conn_state	Connection state (S0, SF, REJ…)

Pivot with uidThe uid of a suspicious connection in conn.log finds its DNS query, HTTP request and transferred files in the other logs.

Connection states (conn_state)

State	Meaning
S0	Attempt with no answer (SYN only)
S1	Connection established, not yet terminated
SF	Connection established then closed normally
REJ	Attempt rejected (RST in reply to the SYN)
RSTO	Connection aborted by the originator (RST)
RSTR	Connection aborted by the responder (RST)
OTH	No SYN seen: connection picked up midstream

What should raise a flagMany S0 or REJ from one source: scan. Regular connections of constant size to one destination: beaconing. orig_bytes far above resp_bytes: data being sent, possible exfiltration.