Note: Our current website is at www.zeek.org. This website is unmaintained and contains outdated information.
Packet Traces
When experimenting with Zeek it is often very useful to work offline from trace files. Unfortunately (though not suprisingly) there aren’t many public traces of significant volume online. We collect some resources on this page that we are aware, but please keep in mind that none of these actually reflect what you find on a real network link.
Public Trace Files
- NPS "Nitroba University Harassment Scenario"
- Simulated traffic created for a security exercise (2012).
- NPS "M57-Patents Scenario"
- Simulated traffic created for a security exercise (2009).
- ITOC Defense Competition
- Traffic recorded during a Cyber Defense Competition at West Point (2009).
- DefCon 8 Traces
- Packet traces captures during the DefCon 8 CTF contest (2006).
- LBNL Enterprise Traffic
- About 100 hours of anonymized header-only traces of internal LBNL traffic (2004/05).
- LBNL FTP traces
- About 10 days worth of anonymized LBNL FTP traffic.
- Lincoln Labs DARPA Sets
- Traces captured in a simulated lab network, originally used within for a NIDS evaluation study (1998/99).
Trace Repositories and Other Lists
- OpenPacket
- A repository of many, usually smaller trace files.
- pcapr
- Another repository of many, usually smaller trace files.
- Netressec’s List of PCAP Files
- An extensive list of publically available traces.
Page Contents
Quick Links
- 13 February 2020: Ask the Zeeksperts - Aashish Sharma
- 18 February 2020 - Portland OR: Zeek Days Workshops
- 27 February 2020: Ask the Zeeksperts
- 7-9 October 2020 - Austin, Texas: ZeekWeek 2020
