Zeek Home Network Monitoring

Zeek (formerly Bro) is a powerful passive network monitoring tool that generates detailed logs of network activity (HTTP, DNS, SSL, etc.) and configure rules for anomaly detection. If you are a network tinkerer like me, and want to monitor your own home network traffic, Zeek is a great tool to start with. In this blogpost, I'll walk through how I set up Zeek to monitor my home network using a Raspberry Pi and an ASUS router I had lying around.

Hardware Configuration

I use a Raspberry Pi 5 (8GB RAM) to run Zeek and other tools to monitor my network traffic (e.g., I use pi-hole as a DNS sinkhole to block tracking requests). For the crux of the setup, I use the Asuswrt-Merlin firmware on the ASUS router to forward traffic to the Raspberry Pi via iptables. Indeed, a cheap managed switch that can does traffic mirroring (e.g., TP-link TL-SG108E) certainly helps! The only downside is that this is a Layer 3 mirroring, which means it's not a packet-level full mirror (which managed switches may offer), but works if the volume of traffic is not too high (ideal for a small home network). Overall, this approach requires:

Network Connections

Network connection diagram showing the Zeek monitoring setup

ASUS Router Configuration

Zeek Configuration

Follow the Zeek installation instructions to install Zeek for your Raspberry Pi (I used the Debian version for arm64). After installation, I edited the following configuration files: 

# /opt/zeek/etc/networks.cfg
# Address ~ Label for the network
192.168.0.0/16  Home network

# /opt/zeek/etc/node.cfg [zeek]
type=standalone
host=localhost
interface=eth0

# /opt/zeek/etc/zeekctl.cfg
# Optional: Configure email notifications for alerts
# and increasing the log rotation interval.
MailTo="email@domain.com"
LogRotationInterval = 7200

Grafana Dashboard

To visualize the network traffic, I use Grafana installed on the Raspberry Pi. Firstly, follow this guide to install Grafana on a Raspberry Pi. Next, you would want to bootstrap a simple way to ingest the zeek logs to a database which Grafana can query. I've attached a partly vibe-coded script in this repo that converts Zeek logs to a SQLite database for easier querying. You would want to place this script into a cron job to run periodically (and I write the default output into /var/lib/grafana/data/zeek_logs.db). Lastly, Grafana offers some pre-built dashboards for Zeek (e.g., pcap-did-what), which I customized to track the metrics I care about most. You can use the graphana-queries.sql file to get started.

Grafana dashboard showing Zeek network monitoring metrics

Event Notifications

There are a lot of things one can do with this setup now. Yacin Nadji (who also uses Zeek for home network monitoring!) has a blogpost on adding Telegram notifications to Zeek. The full blogpost is available at: Telegram Zeek: You're My Main Notice, and also includes how you can trigger custom actions when certain events occur.

What's Next?

At this point, I'm still chasing down packets and trying to understand what's going on. For example, Apple's ecosystem seems to use mDNS to broadcast that they exist (e.g., _companion-link._tcp.local, _airplay._tcp.local). This ultimately led to me learn what Apple's Bonjour was. Same goes for Spotify (maybe device discovery is required for their cast feature?). Shockingly, my Unifi switch seems to call home to ui.com quite a lot! I'm yet to track down why that is.

Send me a note if you think there's other interesting ideas to explore here!

References