## Zeek (formerly Bro)

Wireshark is great for 1 packet. Zeek is great for 1 million packets.

### What is Zeek?
It acts like a NIDS, but instead of "Alerting", it generate **Transaction Logs**.
It summarizes traffic into readable Tab-Separated Values (TSV) logs.

### Key Logs
*   **conn.log**: All TCP/UDP connections. (Source, Dest, Duration, Bytes).
*   **http.log**: All HTTP requests (URI, User-Agent, Referrer).
*   **dns.log**: All DNS queries.
*   **ssl.log**: SSL certificates seen.

### Why use it?
NTA with Zeek is faster.
*   **Question**: "Did anyone visit `evil.com`?"
*   *Wireshark*: Open 50GB pcap, wait 10 minutes to load, filter `dns contains evil`.
*   *Zeek*: `grep "evil.com" dns.log`. (Instant).