Network Attack Reconstruction

Network Forensics: Zeek & Suricata Basics

Introduction

Network forensics is the process of capturing, analyzing, and investigating network traffic to understand security incidents. Two popular tools used for this purpose are Zeek and Suricata. Both help analysts detect attacks, monitor traffic, and gather evidence during investigations.

What is Zeek?

Zeek (formerly Bro) is a powerful network monitoring and analysis framework. It is not a traditional IDS. Instead, it focuses on logging and analyzing what is happening on a network.

Key Features of Zeek

• Deep traffic analysis

• Generates detailed logs (HTTP, DNS, SSL, SSH, etc.)

• Scripting language for custom detection

• Ideal for forensic investigations

What Zeek Does in Network Forensics

• Records everything important happening in network traffic

• Helps track attacker actions

• Provides logs that show connections, file transfers, commands, and protocols used

Common Zeek Logs

• conn.log – All network connections

• http.log – Web traffic details

• dns.log – DNS queries and responses

• ssl.log – SSL/TLS information

• files.log – Files seen on the network

• notice.log – Alerts or abnormal activities

These logs are very useful when reconstructing what happened during an incident.

What is Suricata?

Suricata is an open-source IDS/IPS and network security engine. It uses rules/signatures to detect attacks and suspicious patterns in traffic.

Key Features of Suricata

• Rule-based detection (like Snort rules)

• Protocol identification

• Live intrusion detection and prevention

• High-performance packet inspection

• Can produce JSON logs

What Suricata Does in Network Forensics

• Detects known attacks

• Alerts on suspicious patterns

• Captures metadata about network events

• Helps analysts quickly identify malicious traffic

• Generates logs that can be used for investigation

Important Suricata Logs

• eve.json – Main log with alerts, flows, DNS, HTTP, TLS, etc.

• stats.log – Performance statistics

• fast.log – Quick alert log

Zeek vs. Suricata (Simple Comparison)

Both tools complement each other and are often used together for stronger visibility.

How They Help in Network Forensics

Zeek

• Shows attacker behavior

• Builds a timeline of events

• Tracks protocol details

• Helps understand “what happened” in an attack

Suricata

• Detects attacks in real time

• Produces alerts for known threats

• Identifies malicious patterns

• Helps quickly find suspicious traffic

Basic Workflow in an Investigation

1. Capture traffic (PCAP or live sniffing)

2. Run Zeek to generate detailed logs

3. Run Suricata to detect alerts and suspicious signatures

4. Correlate logs and alerts

5. Reconstruct events

6. Identify attacker actions

7. Document findings

Intel Dump

Zeek and Suricata are essential tools for network forensics.

• Zeek focuses on deep analysis and detailed logs.

• Suricata focuses on real-time detection and alerts.
  Using both together provides a strong forensic view of network activity and helps investigators quickly understand and respond to incidents.