Network Security Monitoring: Metadata Logging vs. Full Packet Capture

Zeek (formerly Bro) and Arkime (formerly Moloch) represent the two premier open-source network security forensics platforms in 2026. While Arkime delivers comprehensive full-packet capture (PCAP) with sub-second Wireshark-style session reconstruction, Zeek delivers lightweight, high-performance protocol transaction logging and JA4+ TLS client fingerprinting that scales across 10GbE enterprise backbones without exhausting storage arrays.

When an advanced threat actor breaches network defenses, traditional signature-based Intrusion Detection Systems (like Snort or Suricata) often remain silent if the attacker uses custom compiled binaries or novel C2 infrastructure. As we demonstrated in our benchmark comparison of Suricata 7 vs. Snort 3 for multi-threading line-rate inspection, signature matching only catches threats you already know about.

To detect lateral movement, data exfiltration, and beaconing inside encrypted sessions, network security teams require Network Security Monitoring (NSM) and full forensic reconstruction.

In 2026, security analysts deploy two complementary architectures: **Zeek**, which acts as a stateful protocol parser and behavioral sensor, and **Arkime**, which functions as an indexed full-packet capture search engine.

JA4+ TLS Fingerprinting: Hunting Inside Encrypted Paywalls

Over 95% of modern internet traffic is encrypted with TLS 1.3. When an adversary establishes an encrypted connection to a Cobalt Strike, Mythic, or Sliver Command-and-Control server, traditional packet inspection sees only random encrypted bytes.

Historically, defenders used Salesforce’s JA3 fingerprinting. However, in 2026, JA3 is obsolete due to TLS 1.3 extension randomization and GREASE (Generate Random Extensions And Sustain Extensibility) injection by modern web browsers.

Zeek solves this through the modern **JA4+ suite** developed by John Althouse and FoxIO. JA4 dissects the initial unencrypted `Client Hello` packet into an easily searchable, standardized alphanumeric string:

t13d1516h2_8daaf6152771_012e499d94e6

The JA4 fingerprint structure breaks down into three distinct components:

1. Protocol and Cipher Overview (`t13d1516h2`): `t` indicates TCP transport, `13` indicates TLS 1.3, `d` indicates SNI domain is present, `15` cipher suites offered, `16` extensions present, and `h2` indicates HTTP/2 ALPN negotiation.
2. Truncated Hash of Cipher Suites (`8daaf6152771`): An exact SHA-256 hash of the sorted cipher suites offered by the client.
3. Truncated Hash of Extensions and Algorithms (`012e499d94e6`): A signature of the extension list and signature algorithms.

Because malicious tools (like Python `requests`, Go HTTP clients, or customized malware implants) use distinct, hardcoded TLS libraries rather than legitimate Chrome or Safari browser network stacks, their JA4 fingerprint immediately sticks out like a beacon. Security teams can alert on any internal host emitting a Python or Go JA4 fingerprint communicating with external IP addresses.

Arkime’s Interactive Session Reconstruction

While Zeek tells you *what happened* in structured logs, Arkime gives you *the exact evidentiary proof*. When an unencrypted protocol or lateral movement attack occurs (such as SMB file transfers or unencrypted database queries), Arkime’s web interface allows investigators to click on a session and view the reconstructed stream in color-coded ASCII, hex, or packet view.

Investigators can extract transferred files, replay VoIP calls, and inspect raw packet headers with a single click. In high-stakes regulatory investigations or incident response triage, having raw PCAP indexed by Arkime is the difference between proving data exfiltration and guessing.

In modern enterprise SOCs, engineers deploy a **symbiotic pipeline**: Zeek monitors the raw TAP or SPAN port, streaming structured logs into a central SIEM like Wazuh vs. Zeek vs. Suricata SIEM architecture. Arkime runs in parallel with ring-buffer storage, keeping a rolling 7-day archive of full PCAP. When Zeek alerts on an anomaly, analysts use the exact timestamp and IP tuple to pull the raw PCAP directly from Arkime.

People Also Ask

Can Zeek run on a Raspberry Pi or low-power mini PC?
Zeek can run on low-power hardware (like an Intel N100 or Raspberry Pi 5) for home networks with bandwidth under 200Mbps. For 1Gbps or 10GbE enterprise networks, Zeek requires a multi-core processor (8+ cores) and high-speed packet capture drivers like AF_PACKET or PF_RING to prevent packet drops.

Does Arkime decrypt HTTPS traffic automatically?
No, Arkime cannot decrypt HTTPS traffic unless you provide the server’s private TLS keys or upload client pre-master secret SSLKEYLOG files. However, it indexes all unencrypted handshake metadata (SNI, certificates, IP addresses, ports) to enable fast searching.

How do I deploy JA4 fingerprinting in Zeek?
JA4 is easily deployed in Zeek using the official FoxIO JA4 Zeek package via the `zkg` (Zeek Package Manager) command: `zkg install ja4`. Once enabled, Zeek automatically populates a new `ja4` field in its standard `ssl.log` output.