While we do not have a comprehensive development guide at the moment, there are some How-Tos documenting specific parts of Zeek source code. Note that some specifics might have changed since the text was written, the authoritative source is always the source code obviously.

Development Process

A summary of our Git-based development process, including instructions for developers and maintainers.

CMake Project Organization

Description of Zeek’s CMake-based build infrastructure.

Usage of bifcl

Description of using Zeek’s bifcl tool for defining built-in functions, variables, and types.

BTest

Documentation for the shell-based unit testing framework we use, called BTest.

Starting Points

Collection of a few starting points for looking at Zeek’s source code.

Adding Analyzers

Overview of hooking a new protocol analyzer into Zeek’s processing.

BinPAC Sample Analyzer

A BinPAC-based skeleton analyzer that can be used as a starting point for parsing new protocols.

File Analysis API and File IDs

A short guide to using the file analysis interface appropriately and how unique file IDs are chosen/calculated.

Finding Memory Leaks

Strategies for finding memory leaks.

Serialization

Zeek can serialize instances of many of its classes into binary form. This How-To documents how to add such support to a class.

Connection Timers

A summary of the internal timers associated with a connection object.

Zeek Scripting Conventions

Best-practices and standard conventions used when writing in the Zeek scripting language.

Writing Documentation

Guidelines for writing documentation and documenting policy scripts.