How to install Zeek on Ubuntu 26.04 LTS

 Zeek Network Security Monitor

Complete Installation & Deployment Guide for Ubuntu 26.04 LTS

1. Add Zeek Repository & Install Binary Package

Zeek maintains official pre-compiled packages via the OpenSUSE Build Service. Execute the following commands to add the repository and install Zeek:

# A. Update package lists and install required repository tools

sudo apt update && sudo apt install -y curl gnupg2 wget

# B. Import the official Zeek repository GPG key

curl -fsSL https://download.opensuse.org/repositories/security:zeek/xUbuntu_26.04/Release.key |

gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/security_zeek.gpg > /dev/null

# C. Add the Zeek repository source list

echo 'deb http://download.opensuse.org/repositories/security:/zeek/xUbuntu_26.04/ /' | sudo

tee /etc/apt/sources.list.d/security:zeek.list

# D. Update index and install Zeek

sudo apt update

sudo apt install -y zeek

#Mail Server Configuration Prompt

During installation, Postfix may prompt for mail server configuration. Select Local only and press Enter to continue.

2. Install Required Python Dependencies

Zeek Control ( zeekctl ) relies on the Python websockets module (v11.0+) for diagnostic and operational commands like print and netstats . Install it via apt to avoid ModuleNotFoundError warnings:

# Install websockets package via APT (recommended for PEP 668 compliance)

sudo apt install -y python3-websockets

Note: If python3-websockets is missing or outdated in your environment, install via pip using: sudo pip3 install --break-system-packages "websockets>=11.0" .

3. Configure Environment Path

Zeek binaries reside in /opt/zeek/bin . Export this path into your shell configuration:

# Add Zeek binary path to user profile

echo 'export PATH=$PATH:/opt/zeek/bin' >> ~/.bashrc

# Reload shell configuration

source ~/.bashrc

# Verify binary execution and version

zeek --version

4. Configure Network Interface & Local Networks

Specify the network interface to monitor and define local CIDR blocks prior to startup.

Identify Active Network Interface:

ip a

Note down your primary interface (e.g., eth0 , ens33 , or enp0s31f6 ).

Configure Interface in /opt/zeek/etc/node.cfg :

sudo nano /opt/zeek/etc/node.cfg

Update the interface entry under the standalone section:

[zeek]

type=standalone

host=localhost

interface=eth0 # Replace with your actual network interface name

Define Internal Networks in /opt/zeek/etc/networks.cfg :

sudo nano /opt/zeek/etc/networks.cfg

Add local CIDR ranges (e.g., 192.168.1.0/24 or 10.0.0.0/8 ) so Zeek properly classifies internal vs. external

traffic.

5. Deploy & Start Zeek Service

Use zeekctl to initialize working directories, validate scripts, and launch the service.

# 1. Initialize working directories and site policies (Fixes 'No work dir found')

sudo zeekctl install

# 2. Validate configuration and script integrity

sudo zeekctl check

# 3. Deploy configuration and start monitoring

sudo zeekctl deploy

# 4. Check operational status

sudo zeekctl status

# 5. Verify diagnostics (should yield zero warnings or errors)

sudo zeekctl diag

Pro Tip

Whenever modifications are made to /opt/zeek/etc/node.cfg or custom policies in /opt/zeek/share/zeek/site/ , always execute sudo zeekctl deploy to compile and apply updates.

LOG FILE DESCRIPTION

conn.log : TCP/UDP/ICMP connections, IP addresses, ports, duration, and byte counts.

dns.log : DNS queries, response codes, resolved IPs, and transaction IDs.

http.log : HTTP requests, user-agents, URIs, status codes, and response headers.

ssl.log : SSL/TLS handshakes, certificate details, SNI, and cipher suites.

weird.log : Protocol anomalies, malformed packets, and unexpected traffic behavior.

COMMAND PURPOSE

sudo zeekctl install : Build working directory structures and cluster layout scripts.

sudo zeekctl deploy : Check configuration, compile policies, and restart/start Zeek.

sudo zeekctl status : Check status of managed Zeek nodes and processes.

sudo zeekctl diag : View diagnostic information and runtime errors/warnings.

sudo zeekctl start : Start background network packet capture and analysis.

sudo zeekctl stop : Gracefully stop Zeek packet capture processes.

sudo zeekctl restart : Restart all Zeek processes.

zeek -r capture.pcap : Analyze an offline PCAP file and output log files in current directory.