Zeek

PCAP → structured protocol logs. Extracts DNS, HTTP, TLS, files, connections into queryable log files.

Installation

# Debian/Ubuntu/Kali
sudo apt install zeek
# or
sudo apt install zeek-core zeekctl

# macOS
brew install zeek

# Docker (no install)
docker run -v $(pwd):/pcap -w /pcap zeek/zeek zeek -r capture.pcap