Re:Brim: Open-source desktop app to analyze large pcaps thro...
by e12e on Monday April 06, 2020 @04:35PM
(#22797540)
Hadn't heard of zeek before - actually find this submarine article useful - it hints better at where and how, than the official zeek documentation. I still don't know what storage space I should budget for a gbps-month of zeek monitoring logs, though (I understand they're typically filtered... But also text?).
https://www.csoonline.com/article/3313050/zeek-a-free-powerf...
As to the where - I guess I need to find some port that can give me a mirror of traffic.... But not that easy with heterogeneous lan+cloud+SaaS setup to figure out where/how to source "all" network traffic :/
Both Wireshark and Zeek use libpcap, which is the de facto standard for raw packet captures, so yes, the same data you'd be feeding to Wireshark to browse, you can also feed to Zeek to analyze.