Zeekurity Zen – Part II: Zeek Package Manager

Zeekurity Zen – Part II: Zeek Package Manager

This is part of the Zeekurity Zen Zeries on building a Zeek (formerly Bro) network sensor.

Overview

In our Zeek journey thus far, we’ve:

  • Set up Zeek to monitor some network traffic.

Now we’ll introduce the Zeek Package Manager to extend Zeek’s functionality with packages contributed by the Zeek community.  A full list of available packages can be viewed on the Zeek Package Browser.  We will focus on configuring Zeek to use AF_PACKET to further optimize packet capture and analysis.  We’ll also install additional useful packages.

To do this, we’ll walkthrough these steps:

  1. Install Zeek Package Manager to extend Zeek’s functionality.
  2. Use Zeek Package Manager to install the AF_PACKET package.
  3. Configure Zeek to use the AF_PACKET package to optimize Zeek’s packet capture performance.
  4. [Optional] Install additional useful packages including ja3 and HASSH.
  5. Update Zeek packages.

Install Zeek Package Manager

  1. As root/sudo install git to download Zeek packages.
    sudo yum install git
  2. As root/sudo install PIP to download Python packages.
    sudo yum install python3-pip
  3. As root/sudo, install Zeek Package Manager (zkg).
    sudo pip3 install zkg
  4. As the zeek user, configure Zeek Package Manager (zkg).
    zkg autoconfig

    This will create a configuration file in /home/zeek/.zkg/config. Upon completion it should look something like the following.

    zeek = https://github.com/zeek/packages
    
    [paths]
    state_dir = /home/zeek/.zkg
    script_dir = /opt/zeek/share/zeek/site
    plugin_dir = /opt/zeek/lib/zeek/plugins
    zeek_dist = /home/zeek/zeek-3.0.0
    

Install the AF_PACKET package

  1. As the zeek user, stop Zeek if it is currently running.
    zeekctl stop
  2. Use zkg to install the AF_PACKET package.
    zkg install zeek/j-gras/bro-af_packet-plugin
    The following packages will be INSTALLED:
      zeek/j-gras/bro-af_packet-plugin (1.4.0)
    
    Proceed? [Y/n] y
    Running unit tests for "zeek/j-gras/bro-af_packet-plugin"
    Installing "zeek/j-gras/bro-af_packet-plugin".......
    Installed "zeek/j-gras/bro-af_packet-plugin" (1.4.0)

Configure Zeek to use AF_PACKET

  1. Edit /opt/zeek/etc/node.cfg to configure Zeek to use AF_PACKET.  In the example configuration below we are configuring a total of two workers, analyzing one sniffing interface.
    # Example ZeekControl node configuration.
    # Below is an example clustered configuration on a single host.
    
    [logger]
    type=logger
    host=localhost
    
    [manager]
    type=manager
    host=localhost
    
    [proxy-1]
    type=proxy
    host=localhost
    
    [worker-1]
    type=worker
    host=localhost
    interface=af_packet::enp2s0
    lb_method=custom
    lb_procs=2
    pin_cpus=0,1
    
    [worker-2]
    type=worker
    host=localhost
    interface=af_packet::enp2s0
    lb_method=custom
    lb_procs=2
    pin_cpus=0,1

    In the event you have two or more sniffing interfaces (e.g. enp2s0 and enp3s0), see the example configuration below which assigns each interface its own worker, again using AF_PACKET. Note the addition of unique af_packet_fanout_id values for each of the sniffing interfaces.

    # Example ZeekControl node configuration.
    # Below is an example clustered configuration on a single host.
    
    [logger]
    type=logger
    host=localhost
    
    [manager]
    type=manager
    host=localhost
    
    [proxy-1]
    type=proxy
    host=localhost
    
    [worker-1]
    type=worker
    host=localhost
    interface=af_packet::enp2s0
    lb_method=custom
    lb_procs=2
    pin_cpus=0,1
    af_packet_fanout_id=2
    
    [worker-2]
    type=worker
    host=localhost
    interface=af_packet::enp3s0
    lb_method=custom
    lb_procs=2
    pin_cpus=0,1
    af_packet_fanout_id=3
  2. As root/sudo, give the Zeek binaries permissions to capture packets. This was previously done in Part I, however, installing AF_PACKET requires doing this again.
    sudo setcap cap_net_raw,cap_net_admin=eip /opt/zeek/bin/zeek
    sudo setcap cap_net_raw,cap_net_admin=eip /opt/zeek/bin/zeekctl
  3. As the zeek user, run zeekctl deploy to apply configurations and run Zeek.
    zeekctl deploy

    If you see the following errors, try re-running the sudo setcap commands from the previous step.

    zeekctl deploy
    Error: worker-1-1 terminated immediately after starting; check output with "diag"
    Error: worker-1-2 terminated immediately after starting; check output with "diag"
    Error: worker-2-1 terminated immediately after starting; check output with "diag"
    Error: worker-2-2 terminated immediately after starting; check output with "diag"

[Optional] Install Additional Useful Packages (e.g. add-interfaces, ja3, and HASSH)

We’ll install additional Zeek packages: add-interfaces, ja3, and HASSH. The install process outlined below should work for installing other packages you may be interested in.

  1. As the zeek user, stop Zeek if it is currently running.
    zeekctl stop
  2. Use zkg to install the add-interfaces package. In situations where you are monitoring multiple network interfaces on one sensor, this adds an “_interface” field to every log file which labels the particular network interface that traffic is coming from.
    zkg install zeek/j-gras/add-interfaces
    The following packages will be INSTALLED:
      zeek/j-gras/add-interfaces (master)
    
    Proceed? [Y/n] y
    Installed "zeek/j-gras/add-interfaces" (master)
    Loaded "zeek/j-gras/add-interfaces"
  3. Edit /opt/zeek/share/zeek/site/add-interfaces/add-interfaces.bro and modify the const enable_all_logs and const include_logs: set[Log::ID] fields as shown below. Save the file when you’ve finished.
    export {
            ## Enables interfaces for all active streams
            const enable_all_logs = T &redef;
            ## Streams not to add interfaces for
            const exclude_logs: set[Log::ID] = { } &redef;
            ## Streams to add interfaces for
            const include_logs: set[Log::ID] = { } &redef;
    }
  4. Use zkg to install the ja3 package. This is used for profiling SSL/TLS clients.
    zkg install zeek/salesforce/ja3
    The following packages will be INSTALLED:
      zeek/salesforce/ja3 (master)
    
    Proceed? [Y/n] y
    Installing "zeek/salesforce/ja3"
    Installed "zeek/salesforce/ja3" (master)
    Loaded "zeek/salesforce/ja3"
  5. Use zkg to install the HASSH package. This is used to profile SSH clients and servers.
    zkg install zeek/salesforce/hassh
    The following packages will be INSTALLED:
      zeek/salesforce/hassh (master)
    
    Proceed? [Y/n] y
    Installing "zeek/salesforce/hassh"
    Installed "zeek/salesforce/hassh" (master)
    Loaded "zeek/salesforce/hassh"
  6. Edit /opt/zeek/share/zeek/site/local.zeek and add the following lines to the bottom. This will load all packages you’ve installed.
    # Load Zeek Packages
    @load packages
  7. As the zeek user, run zeekctl deploy to apply configurations and run Zeek.
    zeekctl deploy

Update Installed Zeek Packages

  1. As the zeek user, stop Zeek if it is currently running.
    zeekctl stop
  2. Use zkg to check for updated packages.
    zkg refresh
    Refresh package source: zeek
            No changes
    Refresh installed packages
            New outdated packages:
                    zeek/salesforce/hassh (master)

    This indicates that zeek/salesforce/hassh needs to be updated.

  3. Use zkg to check for updated packages.
    zkg upgrade
    The following packages will be UPGRADED:
      zeek/salesforce/hassh (master)
    
    Proceed? [Y/n] y
    Upgraded "zeek/salesforce/hassh" (master)
  4. As the zeek user, run zeekctl deploy to apply configurations and run Zeek.
    zeekctl deploy

Up Next

In Part III of this series, we will walkthrough how to send Zeek logs to Splunk and take advantage of the Corelight For Splunk app.


Stuff I Like

Web Hosting: SiteGround

ericooi.com is proudly hosted by SiteGround. Performance and customer service are top notch. Quick and easy https implementation via built-in Let's Encrypt integration.

VPN: Private Internet Access

When I'm using a public internet access point, I use Private Internet Access to secure my connections. Easy to use, fast speeds, and no logs.

Cell Phone: Ting

I don't use many minutes or much data since I'm usually on Wi-Fi, making Ting a smart choice. It features nationwide coverage, fast LTE, and pay as you go rates.


4 thoughts on “Zeekurity Zen – Part II: Zeek Package Manager”

  • Hi Eric, nice posts! very detailed thanks! I was wondering if you ever had this errors before while setting up zkg?
    ~]# zkg autoconfig
    warning: skipped using package source named “zeek”: failed to clone git repo
    Successfully wrote config file to /root/.zkg/config

    ~]# more /root/.zkg/config
    [sources]
    zeek = https://github.com/zeek/packages

    [paths]
    state_dir = /root/.zkg
    script_dir = /opt/zeek/share/zeek/site
    plugin_dir = /opt/zeek/lib/zeek/plugins
    zeek_dist =

    whatever package I try to install, it gives me this error:
    ~]# zkg install zeek/j-gras/bro-af_packet-plugin
    warning: skipped using package source named “zeek”: failed to clone git repo
    error: invalid package “zeek/j-gras/bro-af_packet-plugin”: package name not found in sources and also not a usable git URL (invalid or inaccessible, use -vvv for details)

    Any thoughts?
    many thanks!

    • I’ve got it. it was my company’s VPN blocking it from connecting to the github 🙁
      stderr: ‘fatal: unable to access ‘https://github.com/zeek/packages/’: Peer’s certificate issuer has been marked as not trusted by the user.’
      I disabled the VPN and it worked!
      cheers!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.