Zeek without rc.local
In order for Zeek to properly capture packets you need to disable some network card features, such as tcp offloading and the like.
Security Onion has a handy article at https://blog.securityonion.net/2011/10/when-is-full-packet-capture-not-full.html
While you can just run this manually :
for i in rx tx sg tso ufo gso gro lro; do ethtool -K enp2s0 $i off; done
You don’t really want to be doing this every time the system restarts. Before systemd you might have just put the above command in /etc/rc.local but nowadays systems are not guaranteed to have this legacy feature.
the TLDR is you need to use either systemd to set these options when the system boots. Here is an example systemd service that you can use in place :
# /etc/systemd/system/zeek-interface.service[Service]Type=oneshotRemainAfterExit=yesExecStart=/root/zeek-interface.sh
[Install]WantedBy=multi-user.target
You then need to do a
systemctl daemon-reload
and then
systemctl enable zeek-interface
After you reboot your system should be properly configured to capture packets with Zeek or Suricata!
TODO : There is probably a neater way to do this (using Netplan if you are on Ubuntu for example) — see https://netplan.io/faq