Free tools Windows power users keep installed
One-click scans. No signup required.
Install Zeek from the official package repository that matches your VPS distribution, then configure ZeekControl to capture the interface that actually carries the traffic you need to inspect. The reliable sequence is: install a supported package train, expose /opt/zeek/bin in your PATH, test Zeek with a known PCAP, configure a standalone node, deploy it, and verify that live logs such as conn.log continue to receive records.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What Zeek is—and what “Bro” means
Zeek is a network security monitor that turns packets and protocol conversations into structured logs. It can record connection metadata, DNS activity, HTTP transactions, TLS details and other protocol events, and its scripting and package systems let you add detections and analyzers. The project was formerly called Bro; current packages, commands and documentation use the name Zeek. You do not install a separate “Bro” program on a current Linux VPS.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
This guide targets a single VPS running a supported Debian-family image. It uses ZeekControl’s standalone mode, in which one node runs the manager and worker roles locally. A clustered deployment is a different design: it needs several capture and processing nodes, synchronized configuration and a plan for distributing traffic.
Choose an installation method before changing the host
For a normal Ubuntu or Debian VPS, use the official binary repository. It is the least maintenance-intensive option and includes the tools needed for a standard sensor. Consider Docker or a source build only when your operating system, plugin toolchain or operational model requires it.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
| Method | Best fit | Maintenance and access considerations |
|---|---|---|
| Official binary package | Supported Ubuntu or Debian image; one host or a conventional ZeekControl deployment | Fast installation and normal package updates. The package prefix is normally /opt/zeek; the host still needs packet-capture access to the target interface. |
| Official Docker image | Containerized operations or an existing image-management workflow | Zeek and its tools are inside the container, but the container must reach the VPS traffic source and receive suitable packet-capture privileges. Host networking, capabilities, log volumes and restart behavior become your responsibility. Published tags include zeek/zeek:latest, zeek/zeek:lts and version tags; an Amazon ECR mirror is also published. |
| Build from source | An unsupported distribution, a custom patch or a plugin/toolchain requirement not covered by packages | You own compiler dependencies, rebuilds, upgrades and compatibility testing. This is usually unnecessary on a supported Ubuntu or Debian VPS. |
For predictable production changes, choose a versioned release train rather than a moving package name. A rolling package can be appropriate for a lab or when you intentionally want the newest release, but it increases the chance that an upgrade changes analyzers, scripts or output fields.
Check the VPS before installing
Do these checks while logged in with an account that can use sudo. Zeek needs to read packets from a real interface; installing the package on a VPS that never receives the traffic of interest will produce an apparently healthy but empty sensor.
Confirm the distribution and release
cat /etc/os-release
uname -mThe current official package listing names Debian 13 and Ubuntu 22.04, 24.04 and 26.04 repositories. Select the repository path that exactly matches the image. Do not use an Ubuntu repository on Debian, and do not substitute one Ubuntu release for another. Package availability and release-train names can change, so check the currently listed train immediately before a production install.
Find the interface that carries the traffic
ip -br linkRecord the interface name that will be captured, such as eth0 or a provider-specific virtual NIC. The name shown by this command is the value that belongs in ZeekControl’s node.cfg; it is not necessarily the interface used for your SSH session. If the provider gives you several NICs, determine which one receives mirrored, bridged or otherwise relevant traffic.
Check provider and host constraints
- Ask whether the VPS exposes the traffic you intend to monitor. Ordinary tenant VPS networking usually shows only that tenant’s traffic, not the provider’s physical host or other customers.
- Confirm that packet capture and promiscuous mode are allowed on the selected virtual interface. ZeekControl’s requirement is explicit: a standalone or worker node must access the target interface in promiscuous mode.
- Review security groups, host firewalls, virtual-NIC visibility and hardware offload behavior. These can affect what packets reach the capture path even when Zeek itself is configured correctly.
- Reserve enough storage for the retention period you actually need. There is no universal CPU, RAM or throughput number that applies to every VPS: traffic rate, enabled analyzers, script packages and log retention determine the load.
Install Zeek from the matching official repository
The following example is for Ubuntu 24.04. Replace every xUbuntu_24.04 occurrence with the repository path for your exact supported Ubuntu release, or follow the Debian path listed by the official package wiki. The repository URL is https://download.opensuse.org/repositories/security:/zeek/xUbuntu_24.04/.
-
Add the repository definition:
echo 'deb https://download.opensuse.org/repositories/security:/zeek/xUbuntu_24.04/ /' | sudo tee /etc/apt/sources.list.d/security:zeek.list -
Install the repository signing key:
curl -fsSL https://download.opensuse.org/repositories/security:/zeek/xUbuntu_24.04/Release.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/security_zeek.gpg >/dev/nullThe key is also available at https://download.opensuse.org/repositories/security:/zeek/xUbuntu_24.04/Release.key.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Refresh APT metadata:
sudo apt update -
Install the package train you selected:
sudo apt install zeek-8.0
The package wiki lists zeek, zeek-8.0, zeek-rc and zeek-nightly as choices. Use a versioned train such as zeek-8.0 when you want controlled upgrades. Use the generic zeek package when following the latest release is intentional. zeek-rc is a release-candidate channel, while zeek-nightly follows development builds; reserve both for testing unless you have a specific compatibility reason.
If apt reports that the package cannot be found, stop and re-check the distribution string, repository path and currently published package names. Do not “fix” the error by pointing a different operating-system repository at the host.
Make the Zeek commands available and verify the install
The primary binary-package prefix is /opt/zeek. The installation includes Zeek, ZeekControl, zkg and the Spicy toolchain. Add the binary directory to the administrative user’s path:
echo 'export PATH=/opt/zeek/bin:$PATH' | sudo tee /etc/profile.d/zeek.sh
. /etc/profile.d/zeek.sh
zeek --versionIf you do not want a profile change, call the full paths instead:
/opt/zeek/bin/zeek --version
sudo /opt/zeek/bin/zeekctl versionThe version output confirms that the executable is present, but it does not prove that packet capture works. Perform the PCAP test and live-interface checks below before treating the sensor as operational.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Configure one VPS as a standalone Zeek sensor
ZeekControl reads three key configuration files. On a binary installation they are normally under /opt/zeek/etc: node.cfg defines nodes and interfaces, networks.cfg describes networks considered local, and zeekctl.cfg contains site-wide ZeekControl settings.
Set the capture interface in node.cfg
Open the node file:
sudo nano /opt/zeek/etc/node.cfgFor a single-node sensor, use a standalone entry and replace eth0 with the interface identified earlier:
[zeek]
type=standalone
host=localhost
interface=eth0Do not list an interface that exists only inside another namespace, belongs to a management network with no relevant traffic, or is hidden by the VPS provider. If your provider supplies a dedicated capture NIC, use that NIC and keep management traffic separate where practical.
Describe local networks in networks.cfg
Open the networks file:
sudo nano /opt/zeek/etc/networks.cfgAdd the CIDR ranges that are local to this sensor, one network per line with a short description. For example, replace the illustrative range below with your actual private network:
10.20.0.0/16 Application networkDo not copy this range unless it is really yours. Zeek uses the local-network definition when classifying traffic; an incorrect entry can make logs and notices harder to interpret even though packet capture still works.
Review zeekctl.cfg before deployment
Inspect the site-wide file for the log directory, spool directory and other local settings:
sudo nano /opt/zeek/etc/zeekctl.cfgKeep the defaults until the sensor is producing valid output. Change one setting at a time, document the reason and ensure that the destination has enough space. Log shipping, rotation and retention are operational decisions; they should be planned before a busy interface fills the VPS disk.
Understand privileges and promiscuous mode
ZeekControl must be able to open the selected interface for capture and enable promiscuous mode. Run deployment with sudo unless your installation has been deliberately configured with equivalent capture capabilities. A provider may reject promiscuous mode, expose only filtered traffic or apply virtualization limits; no Zeek configuration can override those restrictions.
Validate Zeek with a known PCAP first
A PCAP test separates installation and protocol parsing from VPS networking. Use a capture whose contents you are authorized to inspect and work in a clean directory so that old logs cannot be mistaken for new ones.
-
Create a test directory and place a known PCAP there:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.mkdir -p ~/zeek-pcap-test cd ~/zeek-pcap-test ls -lh sample.pcap -
Run Zeek directly against the file:
/opt/zeek/bin/zeek -r sample.pcap -
List the generated logs:
ls -lh head -n 5 conn.log -
Check that the files are readable and contain timestamps and records appropriate to the capture. A small PCAP may not contain every protocol log; the important result is that Zeek starts, parses packets and writes structured output without fatal errors.
Rank #3
GL.iNet GL-MT5000 Brume 3 Wired VPN Security Gateway NO Wi-Fi- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
If this test fails, fix the binary, plugin or input problem before investigating the VPS interface. If it succeeds but the live sensor remains empty, focus on interface selection, capture permissions and the traffic path.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check, deploy and observe the live sensor
ZeekControl’s deploy operation applies the configuration from zeekctl.cfg, node.cfg and networks.cfg, updates the files it manages and starts the configured node. Run the commands in order:
sudo /opt/zeek/bin/zeekctl check
sudo /opt/zeek/bin/zeekctl deploy
sudo /opt/zeek/bin/zeekctl statuscheck catches syntax and configuration problems without starting the sensor. If it reports an error, correct the named file and run the check again. After a successful deployment, status should show the standalone node running.
Watch the current log directory while generating or waiting for authorized traffic on the selected interface:
sudo ls -lh /opt/zeek/logs/current
sudo tail -f /opt/zeek/logs/current/conn.logFile names vary with enabled analyzers, but conn.log is a useful first indicator. Timestamps and record counts should advance when the interface receives traffic. Archived logs are kept under the Zeek log tree according to the installed configuration and rotation behavior; ensure your shipping or retention process reads the location you actually configured.
Troubleshoot an empty or unhealthy sensor
| Symptom | Likely cause | What to check |
|---|---|---|
zeek: command not found |
/opt/zeek/bin is not in the current shell’s path |
Run /opt/zeek/bin/zeek --version, source /etc/profile.d/zeek.sh, or open a new login shell. |
| APT cannot locate the package | Wrong distribution path, unsupported image or changed package-train name | Re-check /etc/os-release, use the matching repository and verify the currently listed train. Never mix Debian and Ubuntu repositories. |
zeekctl check fails |
Syntax error or invalid value in a control file | Read the file and line named in the error, correct node.cfg, networks.cfg or zeekctl.cfg, then rerun check. |
| Node deploys but logs stay empty | Wrong interface, no traffic on that interface, or capture blocked | Compare the configured name with ip -br link; confirm the VPS receives the expected traffic and that the provider permits capture and promiscuous mode. |
| PCAP works but live capture does not | VPS networking, firewall, security-group or virtual-NIC limitation | Investigate the traffic path and host/provider controls rather than changing Zeek scripts first. |
| Logs stop advancing after startup | Traffic stopped, the process exited, storage filled or the capture path changed | Run sudo /opt/zeek/bin/zeekctl status, inspect available disk space and system logs, then verify the interface and provider state. |
| Records appear incomplete | Interface offload behavior, filtered traffic or an analyzer not enabled | Check what packets the VPS actually exposes, review offload and filtering settings, and confirm the relevant analyzer or package is configured. |
Capture only traffic you are authorized to monitor. Zeek’s logs can contain domains, addresses, usernames and other sensitive metadata, so protect the log directory, limit administrative access and define a retention and forwarding policy.
Package upgrades and release-train decisions
A pinned train gives you a change window: test the new Zeek version, its scripts and any zkg packages before applying it to production. A generic package follows the repository’s latest release and reduces manual version selection, but an update can arrive when your team is not prepared to review changed output or resource use. Release-candidate and nightly packages should be isolated from a production sensor unless you explicitly accept that risk.
Before an upgrade, save your site configuration and list installed packages. Afterward, run zeek --version, zeekctl check, a representative PCAP test and a short live-capture validation. Confirm that log fields consumed by your alerting or storage pipeline still exist and that the selected interface remains visible.
When Docker or a source build is the better answer
Docker
The official image is Debian based and contains Zeek, zkg and Spicy. It is useful when your team already manages configuration, upgrades and log shipping as containers. The image alone does not grant visibility into the host: you must provide a traffic source, packet-capture privileges, a place for logs and a restart/update policy. Validate those settings with the same PCAP-first and live-log checks used for a package installation.
Source build
Build from source when the required distribution is not covered by binary packages or you need a custom plugin/toolchain combination. The documented Debian/RPM-family dependencies include CMake, Make, GCC/G++, Flex, Bison, libpcap, OpenSSL, Python 3, SWIG and zlib. A source build increases the work required for security updates, reproducibility and rollback, so record the compiler versions and build options and test the resulting binary before attaching it to a production interface.
Quick Recap
Operational checklist
- Repository path matches the exact Ubuntu or Debian release.
- A deliberate package train is selected and its name is still published.
/opt/zeek/binis in the administrator’sPATH, or full paths are used.node.cfgnames the interface that receives the traffic of interest.- The provider permits packet capture and promiscuous mode on that interface.
networks.cfgcontains accurate local CIDR ranges.- A known PCAP produces readable Zeek logs.
zeekctl check,deployandstatuscomplete successfully.- Live timestamps and record counts advance in
/opt/zeek/logs/current. - Disk capacity, permissions, retention and log forwarding are monitored.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors
