--- title: The Cure for Exceptional Zeek Package Testing (Part 2) –... description: Part two of a three-part series on testing Zeek network security packages walks through hand-crafting Zeek events in BTest when a PCAP isn't available or... canonical: https://daily.dev/posts/the-cure-for-exceptional-zeek-package-testing-part-2-zeek-network-security-monitor-aurwiay1r twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Cure for Exceptional Zeek Package Testing (Part 2) – Zeek Network Security Monitor | daily.dev og:description: Part two of a three-part series on testing Zeek network security packages walks through hand-crafting Zeek events in BTest when a PCAP isn't available or... og:url: https://daily.dev/posts/the-cure-for-exceptional-zeek-package-testing-part-2-zeek-network-security-monitor-aurwiay1r og:image: https://api.daily.dev/og/posts/aUrWiAy1R.png og:image:alt: The Cure for Exceptional Zeek Package Testing (Part 2) – Zeek Network Security Monitor og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Cure for Exceptional Zeek Package Testing (Part 2) – Zeek Network Security Monitor **[Zeek: The Open Source Network Security Monitoring Tool](https://daily.dev/sources/zeek)** · 12 min read · 0 upvotes · 0 comments ## Summary Part two of a three-part series on testing Zeek network security packages walks through hand-crafting Zeek events in BTest when a PCAP isn't available or shareable, then shows how to use Zeek's built-in event tracing flag (-E) to auto-generate event scripts from a PCAP, sanitize sensitive fields like MAC addresses and IPs, and turn them into repeatable BTest cases without writing manual event construction code. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I generate a BTest event trace from a PCAP for Zeek package testing? Run zeek with the -E flag followed by a script name, for example: zeek -Cr sensitive.pcap ip-distance/scripts -E event-trace.zeek. This produces a Zeek script that replays exactly the events seen during that run, which can then be run directly with zeek event-trace.zeek and used as a BTest input after adding the BTest keyword preamble and sanitizing sensitive constants like MAC addresses and IP addresses. _daily.dev surfaces practical Zeek testing techniques for engineers automating network security monitoring pipelines._ ### How do I test a Zeek package without a shareable PCAP file? Manually construct and fire the events your package consumes inside a BTest zeek_init handler, comparing the resulting log against a baseline with btest-diff. This requires building the underlying records, such as conn_id, endpoint, and connection, using helper functions, since Zeek's connection record is a nested structure with several required fields even though the package only reads id.orig_h and id.resp_h. _Developers building network monitoring tooling look to daily.dev for hands-on testing workflows like this._ ### What sensitive data needs to be sanitized in a Zeek event trace before committing it to git? MAC addresses and IP addresses are the main PII concerns in an event trace, since they can uniquely identify devices or networks; string constants such as MAC addresses can be freely search-and-replaced, while addresses are commonly anonymized by changing the first octet, for example to 10, as long as the algorithm being tested tolerates the change. Ports are usually safe to share unless they are uncommon. _daily.dev helps security engineers stay sharp on data-sanitization practices before sharing test fixtures publicly._ ## Similar posts on daily.dev - [Which Zeek Alerts Do You Trust? Practitioners Say It Depends. – Zeek Network Security Monitor](https://daily.dev/posts/which-zeek-alerts-do-you-trust-practitioners-say-it-depends-zeek-network-security-monitor-y4gduqykg) · Zeek: The Open Source Network Security Monitoring Tool · 0 upvotes · 0 comments - [Introducing Zeek 9 – Zeek Network Security Monitor](https://daily.dev/posts/introducing-zeek-9-zeek-network-security-monitor-un6ekyog6) · Zeek: The Open Source Network Security Monitoring Tool · 0 upvotes · 0 comments - [I stopped using Wireshark for first-line troubleshooting after discovering Windows' built-in packet capture tool](https://daily.dev/posts/i-stopped-using-wireshark-for-first-line-troubleshooting-after-discovering-windows-built-in-packet--x4ki42qwx) · XDA Developers · 0 upvotes · 0 comments - [From bytecode to bytes: automated magic packet generation](https://daily.dev/posts/from-bytecode-to-bytes-automated-magic-packet-generation-ts88izwlt) · Cloudflare · 5 upvotes · 0 comments - [Zeek 9.0 Development Update – Zeek Network Security](https://daily.dev/posts/zeek-9-0-development-update-zeek-network-security-8r6qgkxvt) · Zeek: The Open Source Network Security Monitoring Tool · 0 upvotes · 0 comments --- Tags: [#testing](https://daily.dev/tags/testing) [View this post on daily.dev](https://daily.dev/posts/the-cure-for-exceptional-zeek-package-testing-part-2-zeek-network-security-monitor-aurwiay1r) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Cure for Exceptional Zeek Package Testing (Part 2) – Zeek Network Security Monitor","url":"https://daily.dev/posts/the-cure-for-exceptional-zeek-package-testing-part-2-zeek-network-security-monitor-aurwiay1r","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-cure-for-exceptional-zeek-package-testing-part-2-zeek-network-security-monitor-aurwiay1r"},"datePublished":"2026-08-23T12:17:55.468Z","dateModified":"2026-08-23T12:26:28.402Z","description":"Part two of a three-part series on testing Zeek network security packages walks through hand-crafting Zeek events in BTest when a PCAP isn't available or...","image":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","thumbnailUrl":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","isAccessibleForFree":true,"articleSection":"Zeek: The Open Source Network Security Monitoring Tool","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Zeek: The Open Source Network Security Monitoring Tool","logo":"https://media.daily.dev/image/upload/s--FT5PuPzv--/f_auto,q_auto/v1787487427/logos/zeek?_a=BAMAMicg0","url":"https://daily.dev/sources/zeek"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-cure-for-exceptional-zeek-package-testing-part-2-zeek-network-security-monitor-aurwiay1r","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"testing","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Zeek: The Open Source Network Security Monitoring Tool","item":"https://daily.dev/sources/zeek"},{"@type":"ListItem","position":3,"name":"The Cure for Exceptional Zeek Package Testing (Part 2) – Zeek Network Security Monitor"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-cure-for-exceptional-zeek-package-testing-part-2-zeek-network-security-monitor-aurwiay1r#faq","mainEntity":[{"@type":"Question","name":"How can I generate a BTest event trace from a PCAP for Zeek package testing?","acceptedAnswer":{"@type":"Answer","text":"Run zeek with the -E flag followed by a script name, for example: zeek -Cr sensitive.pcap ip-distance/scripts -E event-trace.zeek. This produces a Zeek script that replays exactly the events seen during that run, which can then be run directly with zeek event-trace.zeek and used as a BTest input after adding the BTest keyword preamble and sanitizing sensitive constants like MAC addresses and IP addresses. daily.dev surfaces practical Zeek testing techniques for engineers automating network security monitoring pipelines."}},{"@type":"Question","name":"How do I test a Zeek package without a shareable PCAP file?","acceptedAnswer":{"@type":"Answer","text":"Manually construct and fire the events your package consumes inside a BTest zeek_init handler, comparing the resulting log against a baseline with btest-diff. This requires building the underlying records, such as conn_id, endpoint, and connection, using helper functions, since Zeek's connection record is a nested structure with several required fields even though the package only reads id.orig_h and id.resp_h. Developers building network monitoring tooling look to daily.dev for hands-on testing workflows like this."}},{"@type":"Question","name":"What sensitive data needs to be sanitized in a Zeek event trace before committing it to git?","acceptedAnswer":{"@type":"Answer","text":"MAC addresses and IP addresses are the main PII concerns in an event trace, since they can uniquely identify devices or networks; string constants such as MAC addresses can be freely search-and-replaced, while addresses are commonly anonymized by changing the first octet, for example to 10, as long as the algorithm being tested tolerates the change. Ports are usually safe to share unless they are uncommon. daily.dev helps security engineers stay sharp on data-sanitization practices before sharing test fixtures publicly."}}]} ```