iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Install Zeek from the official repository that matches your VPS distribution, use a versioned package train when predictable upgrades matter, then configure ZeekControl to capture the VPS interface in promiscuous mode. The binary packages install under /opt/zeek. Validate the installation with a known PCAP before deploying the standalone sensor on live traffic.
What Zeek is—and what changed from Bro
Zeek is an open-source network security monitor. It observes packets and produces structured transaction logs such as connection, DNS, HTTP, TLS and SSH records. Those logs can feed an investigation platform, a SIEM or your own scripts. Zeek is not an inline firewall: it does not block packets by itself, and it cannot inspect traffic that never reaches the interface it is monitoring.
The project was called Bro until the name changed to Zeek. Current packages, commands and documentation use zeek; “Bro” in an older tutorial normally refers to the same software family. You do not install a separate “Bro” program on a current Linux VPS.
A one-VPS deployment normally runs Zeek as a standalone node managed by ZeekControl. ZeekControl reads three important configuration files:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
node.cfgdefines the node or worker and the capture interface.networks.cfglists networks that Zeek should treat as local.zeekctl.cfgcontains site-wide ZeekControl settings.
When you run zeekctl deploy, ZeekControl brings the files and processes up to date from those configuration files.
Choose an installation method
For a supported Ubuntu or Debian VPS, the official binary repository is the least labor-intensive option. It gives you Zeek, ZeekControl, zkg and the Spicy toolchain without compiling dependencies yourself.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Method | Best fit | Advantages | Trade-offs |
|---|---|---|---|
| Official APT package | Ubuntu 22.04, 24.04 or 26.04, and Debian 13 images listed by the package wiki | Fast installation, normal package management, ZeekControl and tools included | The repository and package train must match the host distribution; upgrades still require change control |
| Official Docker image | Container-oriented deployments or disposable test environments | Repeatable image, version tags, Zeek, zkg and Spicy included |
The container still needs access to host traffic and packet-capture privileges; host integration and log persistence are your responsibility |
| Build from source | An unsupported distribution or a required plugin/toolchain combination not available in packages | Control over build options and dependency versions | You maintain compilers, libraries, upgrades and security fixes; it is usually unnecessary on a supported VPS |
Zeek publishes Docker tags including zeek/zeek:latest, zeek/zeek:lts and version tags, plus an Amazon ECR mirror. A container does not bypass the networking problem: it must still see the interface or traffic source and have suitable packet-capture privileges.
Check the VPS before installing
Start with a supported image and administrative access. The package workflow below assumes a system using APT and sudo.
- Confirm the distribution and release:
cat /etc/os-release. - Confirm that the image is one of the releases covered by the current official package listing: Debian 13 or Ubuntu 22.04, 24.04 or 26.04.
- Have root or
sudoaccess for repository and packet-capture configuration. - Identify the interface that actually receives the traffic you want to inspect. A practical first check is
ip -br link. - Ask the VPS provider whether the virtual NIC can be opened in promiscuous mode and whether the expected traffic is delivered to the guest. Security groups, virtual-switch settings and interface offloading can affect visibility.
- Reserve storage for logs and any retention or shipping pipeline. No universal CPU, RAM or throughput number is published for this installation; measure your traffic rate, enabled analyzers and retention requirements on the chosen VPS.
Do not install an Ubuntu repository on Debian or use a repository path for a different Ubuntu release. A package may appear to install while leaving you with broken dependencies or an unsupported combination.
Install Zeek from the official APT repository
The following example is for Ubuntu 24.04. Replace every occurrence of xUbuntu_24.04 with the repository path matching the host image. The official package listing also covers Ubuntu 22.04, Ubuntu 26.04 and Debian 13, with distribution-specific paths.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches1. Add the repository
echo 'deb https://download.opensuse.org/repositories/security:/zeek/xUbuntu_24.04/ /' | sudo tee /etc/apt/sources.list.d/security:zeek.list
curl -fsSL https://download.opensuse.org/repositories/security:/zeek/xUbuntu_24.04/Release.key
| gpg --dearmor
| sudo tee /etc/apt/trusted.gpg.d/security_zeek.gpg >/dev/null
sudo apt updateThe first command creates an APT source file. The second downloads the repository signing key and stores its dearmored form so APT can verify package metadata. If you are adapting this for another release, change both repository URLs together; mixing a 24.04 source with a 22.04 or Debian host defeats the point of matching the distribution.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
2. Select the package train
The package wiki lists these choices:
zeek— the generic package that follows the repository’s current release.zeek-8.0— a versioned release train for controlled, predictable upgrades when that train is currently listed.zeek-rc— release-candidate packages; use them only when you intentionally need pre-release software.zeek-nightly— development snapshots; they are unsuitable for a production sensor unless you have a specific testing reason.
For a production VPS where change control matters, choose the currently listed versioned train rather than allowing an unplanned jump to a new major release. Verify the package name in the current official listing immediately before installation because supported distributions and train names change. If tracking the newest release is intentional, install the generic package instead.
3. Install the selected package
sudo apt install zeek-8.0Substitute zeek or another deliberately selected train when that is your policy. The binary installation prefix is normally /opt/zeek. The package includes Zeek itself, ZeekControl, zkg and Spicy, so a separate source checkout is not required for the standard setup.
Put Zeek commands in your PATH
Package binaries are under /opt/zeek/bin. You can call them by their full path, which is explicit and useful in scripts:
sudo /opt/zeek/bin/zeek --version
sudo /opt/zeek/bin/zeekctl versionFor interactive administration, add the directory to the administrative user’s shell PATH. For Bash, append this line to that user’s shell profile and start a new login shell:
echo 'export PATH="/opt/zeek/bin:$PATH"' >> ~/.bashrc
. ~/.bashrc
zeek --version
zeekctl versionIf the commands work only with the full path, inspect the profile you edited and confirm that the current session loaded it. Keep service definitions and automation explicit about the path; a non-interactive service may not read your personal shell profile.
Configure a single-VPS Zeek sensor
1. Identify the capture interface
ip -br linkLook for the interface that receives the traffic of interest, such as the primary Ethernet device or a dedicated monitoring interface. A public-facing VPS often sees only traffic addressed to that virtual machine; it will not automatically see traffic between other tenants or instances. Confirm the provider’s traffic model before treating an empty log as a Zeek fault.
2. Edit node.cfg
Open the ZeekControl configuration under the package installation tree and configure one standalone node. A typical standalone definition has the node name, type and interface on separate lines:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
[zeek]
type=standalone
host=localhost
interface=eth0Replace eth0 with the interface name returned by ip -br link. Keep the node name consistent with the section used by your installed configuration. If your image uses a different interface name, do not copy eth0 literally.
3. Review networks.cfg
List the local networks that are meaningful for this sensor. Zeek uses that information when classifying connections and generating notices. Include only prefixes that belong to the environment you are monitoring; an incorrect local-network list can make external and internal traffic appear reversed in analysis.
4. Review zeekctl.cfg
Use this file for site-wide ZeekControl settings and operational choices. Keep the capture interface dedicated where possible, and decide where logs will be retained or shipped. Avoid changing unrelated defaults until the basic sensor is producing records; every additional analyzer or script increases processing and storage work.
Promiscuous mode and VPS limitations
ZeekControl’s documentation states that a standalone or worker node must have access to the target network interface in promiscuous mode. Promiscuous mode allows the capture process to receive frames beyond packets addressed directly to the guest, subject to what the virtual network exposes. It does not grant visibility that the provider’s virtual switch never delivers.
Recommended Free Tools
- Check that the interface is present inside the guest and is the one configured in
node.cfg. - Check provider controls such as security groups, port mirroring, virtual-NIC visibility and restrictions on promiscuous mode.
- Consider host firewall rules and packet-filtering settings that may prevent capture or block test traffic.
- Be aware that checksum, segmentation and receive offloads can change what a capture sees. Treat offload behavior as a deployment consideration and verify with a known capture.
Do not assume that a public IP makes a VPS a network tap. If the provider supplies only the guest’s own traffic, Zeek can monitor that traffic but cannot observe an entire virtual network without a mirror, tap or equivalent feed.
Check the configuration and deploy
Run the commands with the installed path if /opt/zeek/bin is not in PATH:
sudo /opt/zeek/bin/zeekctl check
sudo /opt/zeek/bin/zeekctl deploy
sudo /opt/zeek/bin/zeekctl statuszeekctl check: catches configuration and script errors before processes are started. Fix every reported error rather than deploying a partial configuration.zeekctl deploy: applies the settings fromzeekctl.cfg,node.cfgandnetworks.cfg, updates the files ZeekControl needs and starts or restarts the node.zeekctl status: confirms whether the standalone process is running. A running process alone does not prove that it is receiving useful packets.
When you change the interface, local networks or scripts, run zeekctl check again and redeploy. Keep a record of the selected package train and configuration so an upgrade can be reproduced or rolled back according to your operating procedure.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Validate Zeek before trusting live output
Validate the binary
zeek --versionIf that command is not found, use /opt/zeek/bin/zeek --version. The result confirms that the executable is installed; it says nothing about packet visibility.
Run the official quickstart style of PCAP test
Before debugging a live VPS interface, run Zeek against a known PCAP in a clean working directory. The test should create readable protocol logs. A minimal pattern is:
mkdir -p ~/zeek-pcap-test
cd ~/zeek-pcap-test
/opt/zeek/bin/zeek -r sample.pcapUse a PCAP you are authorized to analyze. Confirm that files such as conn.log are created and contain records. This separates installation, script and parser problems from provider-level traffic visibility. If the PCAP test fails, fix the local installation before investigating the VPS network.
Watch the live logs
After a successful deployment, inspect the live log directory under the Zeek installation and locate files such as conn.log. Generate or wait for traffic that should cross the configured interface, then check whether timestamps and record counts advance. The exact log path can be confirmed from the active ZeekControl configuration; do not assume a custom path if your deployment changed it.
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo find /opt/zeek -type f -name conn.log -o -name '*.log'
sudo tail -f /opt/zeek/logs/current/conn.logIf your package layout uses a different current-log directory, substitute that path. The important test is that new records appear while the selected interface receives traffic.
Troubleshoot an empty or failed sensor
| Symptom | Likely cause | Action |
|---|---|---|
zeek is “command not found” |
/opt/zeek/bin is not in the current PATH |
Use the full path or add export PATH="/opt/zeek/bin:$PATH" to the administrative shell profile, then reload it. |
| APT cannot find the package or reports dependency conflicts | Wrong distribution path, stale metadata or a package train not listed for that release | Recheck /etc/os-release, correct the repository path, run sudo apt update and verify the currently listed train before retrying. |
zeekctl check fails |
Syntax error, invalid interface, bad network entry or incompatible script | Read the first reported error, correct the referenced configuration, and run check again before deploying. |
status is not healthy after deploy |
Process startup failure, permissions or a configuration error | Run zeekctl check, inspect ZeekControl and current logs, and verify that the service account can access the configuration and capture interface. |
Process runs but conn.log stays empty |
Wrong interface, no expected traffic, no promiscuous-mode access, firewall filtering or provider isolation | Compare node.cfg with ip -br link, confirm traffic reaches the VPS, verify provider capture permissions and test with a known PCAP. |
| Records appear but fields look unusual | Virtual-NIC or checksum/offload behavior, incomplete traffic or incorrect local-network definitions | Check provider and host offload settings, confirm the traffic source, and review networks.cfg. |
| Logs grow until storage is exhausted | Retention, rotation or shipping has not been planned | Set an explicit retention and log-shipping policy, monitor disk usage and keep only the records required for investigations. |
Docker deployment as an alternative
The official image is useful when you want an immutable, repeatable runtime or when Zeek is already part of a container platform. Available tags include zeek/zeek:latest, zeek/zeek:lts and version tags. The image is Debian based and includes Zeek, zkg and Spicy.
Containerizing the process does not remove the need for packet-capture privileges. You must provide the container access to the host or VPS traffic source, expose the intended interface or packet stream, grant the capabilities required by the capture method and persist the logs outside the ephemeral container filesystem. Exact runtime flags depend on your container engine and network design, so validate the image first with a PCAP and then prove that the container can see the live source.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Prefer a pinned image tag rather than latest when repeatability matters. Record the tag, configuration files and capability settings together so redeployments do not silently change Zeek versions or visibility.
When a source build is justified
Compile from source only when the required distribution or plugin toolchain is not covered by binary packages, or when you need a build option unavailable in the repository. The official documentation lists dependencies in the Debian/RPM families including CMake, Make, GCC/G++, Flex, Bison, libpcap, OpenSSL, Python 3, SWIG and zlib.
A source build adds responsibility for tracking those dependencies, applying Zeek updates, preserving the install prefix, integrating ZeekControl, and rebuilding when libraries receive security fixes. On a supported Ubuntu or Debian VPS, the package workflow is normally easier to audit and maintain. If you do compile, keep the build recipe, compiler versions, configure options and resulting package artifacts under change control.
Operational practices after installation
Control upgrades
Pin a versioned release train when predictable upgrades are more important than immediately following the newest release. Test a repository or image update against a copy of your configuration and PCAP validation procedure before applying it to the production sensor. Generic packages and latest images are appropriate only when your operating model deliberately accepts rolling updates.
Protect the sensor
Limit administrative access, keep the host patched and avoid exposing management ports unnecessarily. Zeek logs can contain internal addresses, hostnames, URLs and other sensitive metadata; apply the same access controls and retention rules used for other security telemetry.
Monitor the monitor
- Alert when ZeekControl reports a stopped or unhealthy node.
- Watch disk consumption and confirm that log rotation or shipping is working.
- Periodically generate a known test flow or replay an authorized PCAP so you know the parser and pipeline still produce records.
- Record interface changes, provider migrations and package-train changes because any of them can alter what the sensor can see.
Installation decision in one sentence
For an Ubuntu 22.04, 24.04 or 26.04, or Debian 13 VPS covered by the official repository, install the matching APT package—prefer a listed versioned train for controlled upgrades—use /opt/zeek, configure the real capture interface in node.cfg, ensure promiscuous-mode access, then prove both PCAP parsing and live log growth before relying on the sensor.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
