Zeek, passive open-source network analyzer

I am not a networking or security expert, but this seems like an unusual and interesting tool that I hope is of interest and/or use to someone.

Its homepage (main link) is a bit opaque. But in the documentation page (https://docs.zeek.org/en/master/intro/index.html), it describes itself as:

a passive, open-source network traffic analyzer. It is primarily a security monitor that inspects all traffic on a link in depth for signs of suspicious activity. More generally, however, Zeek supports a wide range of traffic analysis tasks even outside of the security domain, including performance measurements and helping with trouble-shooting.

It also apparently was called "Bro" before changing its name to "Zeek".

I found this tool in the process of researching public suffixes. It is used to implement a program that checks whether a DNS query should be trusted or not, on the basis of whether it's a "trusted subdomain".

The Zeek implementation itself is here, which is mostly just straightforward regex manipulations and if/else checks: https://github.com/corelight/icannTLD/blob/master/scripts/ma....