Zeek

Zeek is the appliance’s packet-level source. It reads from the passive capture interface and writes session metadata as JSON, which Vector picks up and forwards. It is the only source with packet trust, because it is the only one that actually saw the bytes.

What it contributes

Record kind	Contributes
zeek.conn	Session tuples, durations, byte and packet counters per direction, connection state
zeek.dns	Queries and answers seen on the wire
zeek.ssl	TLS handshakes, server names, JA4 fingerprints
zeek.http	Hosts, methods, user agents
zeek.ssh	Client and server software strings
zeek.stats	Its own throughput and resource figures
zeek.capture_loss	The percentage of traffic it knows it missed

The last two are not decoration. zeek.capture_loss is the only honest answer to “is this picture complete”, and it is surfaced directly in health as capture.loss_percent.

How it is bound

Zeek reads the capture interface directly. That interface:

• has no IPv4 and no IPv6 address and no ARP,
• is selected by MAC through a systemd.link unit, so a renumbered PCI slot cannot silently move the capture to the wrong NIC,
• has GRO, LRO, GSO, TSO, TX and RX offloads disabled by a unit that runs before Zeek starts.

That last point matters more than it sounds. With offloads enabled the kernel hands Zeek coalesced super-frames, and both the byte counts and the loss statistics stop describing the wire.

Record retention and replay

Zeek’s own JSON logs are retained on the appliance. That is what makes a replay possible: if a transport or registry misconfiguration caused records to be rejected, you fix the configuration and re-read the retained files rather than losing the window.

The flow collector has no equivalent — it does not write a raw file — so a NetFlow gap can only be recovered if the exporter itself can resend.

Layer-2 addresses

Zeek can log the layer-2 addresses of a connection, and those are extremely useful for device identity: a MAC survives a DHCP lease change and a randomised address is recognisable from the address itself.

It is deliberately not enabled by default, for two reasons:

1. It needs a sensor policy to be loaded, which is a capture configuration change rather than a switch in Nyxtrace.
2. In a routed or mirrored segment, the layer-2 address paired with an address from another subnet is the gateway’s. Treated naively, that address is a strong, administered identity anchor, and every internal peer would resolve to the gateway.

Enabling it therefore comes with a same-segment guard and a rejection of any address seen alongside several subnets. Until that is in place, the identity job does not read layer-2 addresses at all.

Tuning, briefly

The honest advice is: give it cores and watch the loss figure. Zeek is the component that turns CPU into visibility, and the only meaningful tuning signal is capture_loss under real load — including during your backup window, which is usually the busiest minute of the day on a homelab network.