security/zeek 9.0.0 FreeBSD

System for detecting network intruders in real-time

System: FreeBSD
Repository: FreeBSD ports
Maintainer: [email protected]
Last update: 2026-10-21
Commit: a83f2fb354
License: CC-BY-4.0
Categories: security
Package size: 19962.5 KiB, 118806.6 KiB installed

Description

Zeek (formerly known as Bro) is an open-source, Unix-based Network Intrusion Detection System (NIDS) that passively monitors network traffic and looks for suspicious activity. Zeek detects intrusions by first parsing network traffic to extract its application-level semantics and then executing event-oriented analyzers that compare the activity with patterns deemed troublesome. Its analysis includes detection of specific attacks (including those defined by signatures, but also those defined in terms of events) and unusual activities (e.g., certain hosts connecting to certain services, or patterns of failed connection attempts).

Zeek is documented in the USENIX 1998 Security Conference proceedings (as Bro).

In the other systems

System

Port

Version

FreeBSD

security/zeek

9.0.0

OpenBSD

net/bro

8.2.2p0

Install

Binary package:

pkg install zeek

From the ports tree:

cd /usr/ports/security/zeek/ && make install clean

To depend on this port in another port's Makefile:

RUN_DEPENDS=	zeek>0:security/zeek
LIB_DEPENDS=	libbinpac.so:security/zeek

Packages

The version each package repository carries. “-” means the repository builds no package of it, “n/a” that there is no such repository.

Repository	aarch64	amd64	armv6	armv7	i386
FreeBSD:14:latest	9.0.0	9.0.0	-	8.0.1	9.0.0
FreeBSD:14:quarterly	9.0.0	9.0.0	n/a	7.0.9	9.0.0
FreeBSD:15:latest	9.0.0	9.0.0	n/a	-	-
FreeBSD:15:quarterly	9.0.0	9.0.0	n/a	n/a	n/a
FreeBSD:16:latest	9.0.0	9.0.0	n/a	n/a	n/a
FreeBSD:16:quarterly	n/a	n/a	n/a	n/a	n/a

Dependencies

As this port's Makefile names them.

Build 4

bison>=3.3 : devel/bison
flex>=2.6 : textproc/flex
swig>=4.0.2 : devel/swig
${PYTHON_PKGNAMEPREFIX}websockets>=11.0.0 : devel/py-websockets

Library 2

libcares.so : dns/c-ares
libzmq.so : net/libzmq4

Runtime 2

c-ares>=1.25.0 : dns/c-ares
${PYTHON_PKGNAMEPREFIX}websockets>=11.0.0 : devel/py-websockets

The full lists below include those, and their dependencies in turn.

Build dependencies 39

Run dependencies 43

No port depends on this one.

Configuration

Options name: security_zeek

Option

Default

Description

DEBUG

off

Optimizations off, debug symbols/flags on

GEOIP2

Build with GeoIP2 (MaxMindDB) support

IPSUMDUMP

Enables traffic summaries

LBL_CF

Unix time to formated time/date filter support

LBL_HF

Address to hostname filter support

MINSIZEREL

off

Optimizations on, debug symbols/flags off

PERFTOOLS

off

Use Perftools to improve memory & CPU usage

RELEASE

Optimizations on, debug symbols/flags off

RELWITHDEBINFO

off

Optimizations/debug symbols on, debug flags off

SPICY

off

Enable the Spicy parser generator

ZEEKCTL

ZeekControl support (implies IPSUMDUMP)

ZKG

Zeek package manager support

USES: bison cmake compiler:c++20-lang cpe gettext-runtime perl5 python shebangfix ssl
Service scripts: none

Message after installing

The rc.d script now honors the zeek_user rc.d variable.  To run as
a user other than root (the default) you need to make a few changes.
For example to run as the user zeek, add this to /etc/rc.conf:

    zeek_enable="YES"
    zeek_user="zeek"

Add this to /etc/devfs.conf:

    own     bpf     root:bpf
    perm    bpf     0660

And add zeek to the bpf group:

    bpf:*:81:zeek

and restart the devfs service:

    service devfs restart

or reboot.

If the interface defined in node.cfg is configured for NIC checksum
offloading (the default when this feature is supported by the
hardware) you will want to set ignore_checksums in site/local.zeek:

    redef ignore_checksums = T;

During deinstall of this package, the cfg files for zeekctl are not
deleted if you have edited them. Instead the software will create
a .sample file and the edited files will remain in place when you
upgrade. If you want to delete them, you have to remove
/usr/local/etc/zeekctl.cfg manually.

You may also need to manually remove /var/spool/state.db

The default LogDir and SpoolDir have moved from /usr/local to /var.

To migrate an existing installation to the new layout:

 - service zeek stop

 - pkg upgrade -y zeek

 - edit /usr/local/etc/zeekctl.cfg and make these changes:

    LogDir = /var/log/zeek
    SpoolDir = /var/spool/zeek

 - move/create the log directory

 - service zeek deploy

Files

Manual pages 5

trace-summary(1)
zeek(8)
zeek-client(1)
zeek-cut(1)
zeekctl(8)

pkg-plist 2346

bin/bifcl
bin/binpac
bin/capstats
bin/hilti-config
bin/hiltic
bin/paraglob-test
bin/spicy-build
bin/spicy-config
bin/spicy-driver
bin/spicy-dump
bin/spicy-precompile-headers
bin/spicyc
bin/spicyz
bin/trace-summary
bin/zeek
bin/zeek-archiver
bin/zeek-client
bin/zeek-cluster-layout-generator
bin/zeek-config
bin/zeek-cut
bin/zeekctl
@sample etc/networks.cfg.sample
@sample etc/node.cfg.sample
@sample etc/zeek/zeek.conf.sample
@sample etc/zeekctl.cfg.sample
include/binpac/binpac.h
include/binpac/binpac_analyzer.h
include/binpac/binpac_buffer.h
include/binpac/binpac_bytestring.h
include/binpac/binpac_exception.h
include/binpac/binpac_regex.h
include/broker/address.hh
include/broker/alm/multipath.hh
include/broker/alm/routing_table.hh
include/broker/api_flags.hh
include/broker/backend.hh
include/broker/backend_options.hh
include/broker/bad_variant_access.hh
include/broker/broker.hh
include/broker/builder.hh
include/broker/command_envelope.hh
include/broker/config.hh
include/broker/configuration.hh
include/broker/convert.hh
include/broker/cow_tuple.hh
include/broker/data.hh
include/broker/data_envelope.hh
include/broker/defaults.hh
include/broker/detail/abstract_backend.hh
include/broker/detail/appliers.hh
include/broker/detail/assert.hh
include/broker/detail/comparable.hh
include/broker/detail/die.hh
include/broker/detail/filesystem.hh
include/broker/detail/flare.hh
include/broker/detail/hash.hh
include/broker/detail/inspect_enum.hh
include/broker/detail/make_backend.hh
include/broker/detail/memory_backend.hh
include/broker/detail/native_socket.hh
include/broker/detail/opaque_type.hh
include/broker/detail/overload.hh
include/broker/detail/peer_status_map.hh
include/broker/detail/prefix_matcher.hh
include/broker/detail/promote.hh
include/broker/detail/radix_tree.hh
include/broker/detail/sink_driver.hh
include/broker/detail/source_driver.hh
include/broker/detail/sqlite_backend.hh
include/broker/detail/store_state.hh
include/broker/detail/type_traits.hh
include/broker/domain_options.hh
include/broker/endpoint.hh
include/broker/endpoint_id.hh
include/broker/endpoint_info.hh
include/broker/entity_id.hh
include/broker/enum_value.hh
include/broker/envelope.hh
include/broker/error.hh
include/broker/event.hh
include/broker/event_observer.hh
include/broker/expected.hh
include/broker/filter_type.hh
include/broker/format/bin.hh
include/broker/format/json.hh
include/broker/format/txt.hh
include/broker/frontend.hh
include/broker/fwd.hh
include/broker/hub.hh
include/broker/hub_id.hh
include/broker/internal_command.hh
include/broker/intrusive_ptr.hh
include/broker/lamport_timestamp.hh
include/broker/logger.hh
include/broker/mailbox.hh
include/broker/message.hh
include/broker/network_info.hh
include/broker/none.hh
include/broker/overflow_policy.hh
include/broker/p2p_message_type.hh

The first 100 are listed.

distinfo 1

File

Size

SHA256

zeek-9.0.0.tar.gz

1.00698813e+08

1345474b3ea04c700f5421c30c7b81cf570056a16842abba03dfa5e2b6e3ed4e

Master sites 1

https://download.zeek.org/

Commit history 7

Date Commit Credits Log message

2026-10-21

a83f2fb354

Piotr Kubaj

security/zeek: fix build on powerpc64

The 9.0.0 update dropped the powerpc64 patches from 144863452393. Bring back the ones still needed: the VSX hash kernel stays off on big-endian (it computes wrong hashes there) and the bundled fiber library enables its ppc64 ELFv2 assembly on big-endian too (upstream simonfxr/fiber dc084920bc81). The hilti stack-direction change is upstream now.

2026-09-15

031e50f70f

Craig Leres

security/zeek: Update to 9.0.0

This is the next long-term support (LTS) release of zeek. https://github.com/zeek/zeek/releases/tag/v9.0.0 https://zeek.org/2026/08/zeek-9-0-development-update/ Reported by: Tim Wojtulewicz

2026-09-11

1448634523

Piotr Kubaj

security/zeek: drop VSX requirement and enable SPICY on powerpc64*

With the patch, VSX is now not required. SPICY support is already in place, just requires enabling it in the source. While here, properly mark spicy files as needing SPICY enabled.

2026-08-19

a2cc1eae85

Craig Leres

security/zeek: Update to 8.0.10

https://github.com/zeek/zeek/releases/tag/v8.0.10 This release fixes the following vulnerabilities: - HIGH: SMB: Chains of AndX messages can crash Zeek - HIGH: DNP3: Memory exhaustion via file control (g70v1) fields - HIGH: SIP: Memory exhaustion from long request/response paths - HIGH: DHCP: Memory exhaustion from retained options after analyzer violation - HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path entries - HIGH: SMB: DCE/RPC memory exhaustion from fragment state - HIGH: Analyzer manager: Equivalent scheduled analyzers could exhaust memory - HIGH: ZIP: Unbounded decompression - HIGH: Redis: Parsed Redis traffic memory exhaustion - HIGH: Invalid IPv6 fragments can lead to unbounded state growth …

2026-07-13

6dda64c6b5

Craig Leres

security/zeek: Remove /var/spool/zeek/zeekctl-config.sh on uninstall

... and remove from pkg-plist as it is automatically generated.

The latest 5 of 7 in the history this site was built from.