| Port details on branch 2024Q4 |
- zeek System for detecting network intruders in real-time
- 7.0.5 security
 =0       7.0.4Version of this port present on the latest quarterly branch. - Maintainer: leres@FreeBSD.org
- Port Added: 2024-10-29 18:18:05
- Last Update: 2024-12-16 21:56:12
- Commit Hash: 334fad1
- License: CC-BY-4.0
- WWW:
- https://www.zeek.org/
- Description:
- Zeek (formerly known as Bro) is an open-source, Unix-based Network
Intrusion Detection System (NIDS) that passively monitors network
traffic and looks for suspicious activity. Zeek detects intrusions
by first parsing network traffic to extract its application-level
semantics and then executing event-oriented analyzers that compare
the activity with patterns deemed troublesome. Its analysis includes
detection of specific attacks (including those defined by signatures,
but also those defined in terms of events) and unusual activities
(e.g., certain hosts connecting to certain services, or patterns
of failed connection attempts).
Zeek is documented in the USENIX 1998 Security Conference proceedings
(as Bro).
  ¦  ¦  ¦  ¦ 
- Manual pages:
- FreshPorts has no man page information for this port.
- pkg-plist: as obtained via:
make generate-plist - Dependency lines:
-
- To install the port:
- cd /usr/ports/security/zeek/ && make install clean
- To add the package, run one of these commands:
- pkg install security/zeek
- pkg install zeek
NOTE: If this package has multiple flavors (see below), then use one of them instead of the name specified above.- PKGNAME: zeek
- Flavors: there is no flavor information for this port.
- distinfo:
- TIMESTAMP = 1734375827
SHA256 (zeek-7.0.5.tar.gz) = e0e6e6f5d5b0402bb1ccd02ecee0ac5bd237d60c5095d71a146651c7f6721eb7
SIZE (zeek-7.0.5.tar.gz) = 95847393
No package information for this port in our database- Sometimes this happens. Not all ports have packages. Perhaps there is a build error. Check the fallout link:
- Dependencies
- NOTE: FreshPorts displays only information on required and default dependencies. Optional dependencies are not covered.
- Build dependencies:
-
- bison>=3.3 : devel/bison
- flex>=2.6 : textproc/flex
- swig>=4.0.2 : devel/swig
- ipsumdump : net/ipsumdump
- bash : shells/bash
- py311-sqlite3>0 : databases/py-sqlite3@py311
- bison : devel/bison
- cmake : devel/cmake-core
- ninja : devel/ninja
- python3.11 : lang/python311
- perl5>=5.36<5.37 : lang/perl5.36
- Test dependencies:
-
- python3.11 : lang/python311
- Runtime dependencies:
-
- c-ares>=1.25.0 : dns/c-ares
- ipsumdump : net/ipsumdump
- cf : sysutils/lbl-cf
- hf : sysutils/lbl-hf
- bash : shells/bash
- py311-sqlite3>0 : databases/py-sqlite3@py311
- py311-zkg>=2.7.1 : security/py-zkg@py311
- python3.11 : lang/python311
- perl5>=5.36<5.37 : lang/perl5.36
- Library dependencies:
-
- libcares.so : dns/c-ares
- libmaxminddb.so : net/libmaxminddb
- There are no ports dependent upon this port
Configuration Options:- ===> The following configuration options are available for zeek-7.0.5:
GEOIP2=on: Build with GeoIP2 (MaxMindDB) support
IPSUMDUMP=on: Enables traffic summaries
LBL_CF=on: Unix time to formated time/date filter support
LBL_HF=on: Address to hostname filter support
PERFTOOLS=off: Use Perftools to improve memory & CPU usage
SPICY=on: Enable the Spicy parser generator
ZEEKCTL=on: ZeekControl support (implies IPSUMDUMP)
ZKG=on: Zeek package manager support
====> Options available for the single BUILD_TYPE: you have to select exactly one of them
DEBUG=off: Optimizations off, debug symbols/flags on
MINSIZEREL=off: Optimizations on, debug symbols/flags off
RELEASE=on: Optimizations on, debug symbols/flags off
RELWITHDEBINFO=off: Optimizations/debug symbols on, debug flags off
===> Use 'make config' to modify these settings
- Options name:
- security_zeek
- USES:
- bison cmake compiler:c++17-lang cpe perl5 python shebangfix ssl
- pkg-message:
- For install:
- The rc.d script now honors the zeek_user rc.d variable. To run as
a user other than root (the default) you need to make a few changes.
For example to run as the user zeek, add this to /etc/rc.conf:
zeek_enable="YES"
zeek_user="zeek"
Add this to /etc/devfs.conf:
own bpf root:bpf
perm bpf 0660
And add zeek to the bpf group:
bpf:*:81:zeek
and restart the devfs service:
service devfs restart
or reboot.
If the interface defined in node.cfg is configured for NIC checksum
offloading (the default when this feature is supported by the
hardware) you will want to set ignore_checksums in site/local.zeek:
redef ignore_checksums = T;
- If removing:
- During deinstall of this package, the cfg files for zeekctl are not
deleted if you have edited them. Instead the software will create
a .sample file and the edited files will remain in place when you
upgrade. If you want to delete them, you have to remove the
/usr/local/etc directory manually.
You may also need to manually remove /usr/local/spool/state.db
- Master Sites:
|
Number of commits found: 3
| Commit History - (may be incomplete: for full details, see links to repositories near top of page) |
| Commit | Credits | Log message |
|---|
7.0.5
16 Dec 2024 21:56:12
 |
Craig Leres (leres) |
security/zeek: Update to 7.0.5
https://github.com/zeek/zeek/releases/tag/v7.0.5
This release fixes the following potential DoS vulnerability:
- Large QUIC packets can cause Zeek to overflow memory and potentially
crash. Due to the possibility of receiving these packets from
remote hosts, this is a DoS risk.
This release fixes the following bugs:
- The ZAM script optimization feature gained some fixes for some
minor memory leaks.
- The ZeekJS submodule was updated to v0.14.0. In certain environment,
ZeekJS would fail to start a debugging thread due to limited
stack size, producing spurious log messages
Reported by: Tim Wojtulewicz
(cherry picked from commit c9f050487dd128e5b517c5472da4fec59ca6de22) |
7.0.4
16 Dec 2024 21:56:12
 |
Craig Leres (leres) |
security/zeek: Update to 7.0.4
https://github.com/zeek/zeek/releases/tag/v7.0.4
This release fixes the following bugs:
- The community-id-logging.zeek policy script was used to set
c$conn$community_id during new_connection() rather than
connection_state_remove(), allowing other scripts to reuse its
value early.
- The input framework will no longer get stuck and use 100% of the
CPU when encountering lines not immediately terminated by a new
line.
(Only the first 15 lines of the commit message are shown above  ) |
7.0.3_1
29 Oct 2024 18:16:56
|
Craig Leres (leres) |
security/zeek: Fix build with clang 19
https://github.com/zeek/zeek/issues/3994
https://github.com/zeek/zeek/pull/3997
Clang 19 with libc++ started failing to compile because the
default implementation of std::char_traits was removed, making
uses of std::char_traits<unsigned char> invalid (by consequence,
also std::basic_string<unsigned char>).
(cherry picked from commit bf3c4a775bda4953b48221234a6e7047cc94b554) |
Number of commits found: 3
|
As an Amazon Associate I earn from qualifying purchases.