zeek

Auth/lab ref: Protocol-aware network analysis engine that converts raw PCAP or live traffic into structured logs (conn.log, dns.log, http.log, ssl.log, files.log, etc.).

Independent GitHub snapshot · Automated classification · Original documentation governs