Zeek package testing without PCAPs: what changes for teams?

TL;DR: Zeek package testing can be driven by manually raised events or by event traces generated from PCAPs, reducing dependence on shareable packet captures and making unit tests easier to build for auxiliary functions and external-service workflows, according to Corelight research. The pattern matters because reproducible security testing often depends on the ability to recreate runtime state without exposing sensitive traffic.

Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “The Cure for Exceptional Zeek Package Testing (Part 2)”.

Key questions

Q: How should teams test Zeek packages when they cannot use a PCAP?

A: Use manual event generation for narrow, deterministic paths and event traces when you need realistic replay.

Q: What is the best way to sanitise a Zeek event trace before sharing it?

A: Start by classifying which constants are sensitive and which are behaviourally important.

Q: When should security teams use manual events instead of event traces?

A: Use manual events when the code path is small, the required fields are few, and you want complete control over the input.

Practitioner guidance

• Build a manual event harness for narrow Zeek code paths Create helper functions that construct only the fields your package consumes, then queue the exact event handler in zeek_init for deterministic BTest coverage.
• Prefer event traces when you need realistic replay Generate traces from a PCAP, prepend the BTest preamble, and run them as scripts so the test reproduces the original event sequence without rebuilding every record by hand.
• Sanitise trace constants before committing them Review time, string, port, and addr constants separately, then remove or generalise values that could expose identifiers, internal hosts, or other sensitive details.

Bottom line: The article shows that Zeek packages can be tested without a shareable PCAP by either manually firing events or replaying generated event traces.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →