Skip to content

Latest commit

 

History

History
21 lines (19 loc) · 618 Bytes

README.md

File metadata and controls

21 lines (19 loc) · 618 Bytes

zeek-tcpreplay

A custom Docker image that uses tcpreplay to feed arbitrary pcaps at arbitrary speed to Zeek via dummy0 NIC.

Built on top of zeekurity/zeek:latest

  1. Get this code. Note - pcap directory contains an 80MB sample file to get you started - this will take a minute or two to download.
git clone https://github.com/berthayes/zeek-tcpreplay && cd zeek-tcpreplay
  1. Build the Docker image (~5 min - YMMV)
docker build -t zeek-tcpreplay .
  1. Start that container!
bash runit.sh
  1. Wait a minute or so for things to start up...
sleep 60 && echo "We should be good to go."