参考：https://www.cnblogs.com/networking/p/14929631.html
zeek官方手册：https://docs.zeek.org/en/v4.2.0/

技巧

加速下载

linux

参考：https://segmentfault.com/a/1190000039686752
如何测试在终端有没有走代理呢？如果输入一下命令返回了谷歌的页面，则表示走代理成功

  1. curl -vv https://www.google.com

image.png
image.png

Windows

Windows大同小异，把export换成set即可

环境变量问题

参考：https://www.cnblogs.com/senlinyang/p/9431855.html
本来想配置环境变量的，看网上和博客上很多说改/etc/profile，然后source /etc/profile之后就可以永久保存使环境变量生效，但是终端一关闭，就环境变量就失效了，其他终端也用不了。网上有说在当前用户目录下创建.bash_profile文件，编写环境变量，然后执行命令source ~/.bash_profile之后就能使这个用户永久生效。但是还是和之前/etc/profile一样，失效了。
解决办法：
在~/.bashrc文件里改环境配置，source ~/.bashrc，最后终于关闭这个终端也有效了。。。

在kali中，需要修改source ~/.zshrc

安装

依赖环境

可能会遇到这个问题，我这里手动修改了报错的文件‘
image.png

  1. ┌──(root㉿kali)-[/usr/…/legion/ui/models/zeek]
  2. └─# apt-get install cmake make gcc g++ flex bison libpcap-dev libssl-dev python3 python3-dev swig zlib1g-dev
  3. Reading package lists... Done
  4. Building dependency tree... Done
  5. Reading state information... Done
  6. bison is already the newest version (2:3.8.2+dfsg-1).
  7. cmake is already the newest version (3.22.1-1+b1).
  8. flex is already the newest version (2.6.4-8).
  9. g++ is already the newest version (4:11.2.0-2).
  10. gcc is already the newest version (4:11.2.0-2).
  11. libpcap-dev is already the newest version (1.10.1-4).
  12. libssl-dev is already the newest version (1.1.1n-1).
  13. make is already the newest version (4.3-4.1).
  14. python3 is already the newest version (3.9.8-1).
  15. python3-dev is already the newest version (3.9.8-1).
  16. swig is already the newest version (4.0.2-2).
  17. zlib1g-dev is already the newest version (1:1.2.11.dfsg-2).
  18. 0 upgraded, 0 newly installed, 0 to remove and 655 not upgraded.
  20. ┌──(root㉿kali)-[/usr/…/legion/ui/models/zeek]
  21. └─# apt-get install gnupg curl
  22. Reading package lists... Done
  23. Building dependency tree... Done
  24. Reading state information... Done
  25. curl is already the newest version (7.81.0-1).
  26. gnupg is already the newest version (2.2.27-3).
  27. 0 upgraded, 0 newly installed, 0 to remove and 655 not upgraded.
  29. ┌──(root㉿kali)-[/usr/…/legion/ui/models/zeek]
  30. └─# apt install -y automake make g++ bison flex libelf-dev libssl-dev bc
  31. Reading package lists... Done
  32. Building dependency tree... Done
  33. Reading state information... Done
  34. automake is already the newest version (1:1.16.5-1.3).
  35. bc is already the newest version (1.07.1-3+b1).
  36. bison is already the newest version (2:3.8.2+dfsg-1).
  37. flex is already the newest version (2.6.4-8).
  38. g++ is already the newest version (4:11.2.0-2).
  39. libelf-dev is already the newest version (0.186-1).
  40. libssl-dev is already the newest version (1.1.1n-1).
  41. make is already the newest version (4.3-4.1).
  42. 0 upgraded, 0 newly installed, 0 to remove and 655 not upgraded.
  44. ┌──(root㉿kali)-[/usr/…/legion/ui/models/zeek]
  45. └─# apt-get install python3-git python3-semantic-version  
  46. Reading package lists... Done
  47. Building dependency tree... Done
  48. Reading state information... Done
  49. python3-git is already the newest version (3.1.24-1).
  50. python3-semantic-version is already the newest version (2.8.5-1).
  51. 0 upgraded, 0 newly installed, 0 to remove and 655 not upgraded.
  53. ┌──(root㉿kali)-[/usr/share/legion/ui/models]
  54. └─# git clone --recursive https://github.com/zeek/zeek
  55. Cloning into 'zeek'...
  56. remote: Enumerating objects: 188401, done.
  57. remote: Counting objects: 100% (790/790), done.
  58. remote: Compressing objects: 100% (478/478), done.
  59. remote: Total 188401 (delta 463), reused 495 (delta 274), pack-reused 187611
  60. Receiving objects: 100% (188401/188401), 117.71 MiB | 17.01 MiB/s, done.
  61. Resolving deltas: 100% (137248/137248), done.
  62. Submodule 'auxil/bifcl' (https://github.com/zeek/bifcl) registered for path 'auxil/bifcl'
  63. Submodule 'auxil/binpac' (https://github.com/zeek/binpac) registered for path 'auxil/binpac'

编译

  1. root@Zeek:~# cd zeek
  2. root@Zeek:~#./configure
  3. root@Zeek:~#make
  4. root@Zeek:~#make install

image.png
image.png

增加zeek环境变量

image.png
临时增加环境变量（不推荐）

  1. [root@Zeek ~]# vim /etc/profile
  2. 在末尾增加
  3. export PATH=/usr/local/zeek/bin:$PATH
  4. [root@Zeek ~]# source /etc/profile

永久增加环境变量（推荐）
image.png

运行

image.png