zeek

Passive network traffic analyzer. Any output and log files will be saved to the current working directory. More information: https://docs.zeek.org/en/lts/quickstart.html#zeek-as-a-command-line-utility.

sudo zeek --iface interface

sudo zeek --iface interface script1 script2

sudo zeek --bare-mode --iface interface

sudo zeek --filter path/to/filter --iface interface

sudo zeek --watchdog --iface interface

zeek --readfile path/to/file.trace