News for hackers. Stuff that matters.
Re:Brim: Open-source desktop app to analyze large pcaps thro... by tptacek on Monday April 06, 2020 @01:30PM (#22795743)
Wireshark dissects protocols and gives debugging traces. Zeek (FKA "Bro") is an intrusion detection system that analyzes debugging traces (which it generates itself, not through Wireshark dissectors) to generate usefully semantic data, ranging from "which hosts are fetching this URL" to "where are there signs of this vulnerability being exploited".

Both Wireshark and Zeek use libpcap, which is the de facto standard for raw packet captures, so yes, the same data you'd be feeding to Wireshark to browse, you can also feed to Zeek to analyze.

Re:Brim: Open-source desktop app to analyze large pcaps thro... by e12e on Monday April 06, 2020 @04:35PM (#22797540)
Hadn't heard of zeek before - actually find this submarine article useful - it hints better at where and how, than the official zeek documentation. I still don't know what storage space I should budget for a gbps-month of zeek monitoring logs, though (I understand they're typically filtered... But also text?).

https://www.csoonline.com/article/3313050/zeek-a-free-powerf...

As to the where - I guess I need to find some port that can give me a mirror of traffic.... But not that easy with heterogeneous lan+cloud+SaaS setup to figure out where/how to source "all" network traffic :/