<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Analyzing Network Flow Data

## Zeek Commands

| Command | Description |
|---|---|
| `zeekctl deploy` | Deploy Zeek cluster |
| `zeekctl status` | Check worker status |
| `zeek-cut field1 field2 < conn.log` | Extract fields from logs |
| `zeek -r capture.pcap` | Process PCAP with Zeek |

## nfdump Commands

| Command | Description |
|---|---|
| `nfdump -R /path -s srcip` | Top source IPs |
| `nfdump -R /path -s dstport` | Top destination ports |
| `nfdump -R /path -o extended` | Extended output format |
| `nfdump -R /path 'bytes > 1M'` | Filter large flows |

## tcpdump / tshark

| Command | Description |
|---|---|
| `tcpdump -i eth0 -w capture.pcap` | Capture packets |
| `tshark -r capture.pcap -q -z conv,tcp` | TCP conversation summary |
| `tshark -r capture.pcap -Y "dns"` | Filter DNS traffic |

## Agent Script

```bash
# Analyze conn.log
node agent.js analyze /var/log/zeek/conn.log

# Detect beaconing
node agent.js beaconing /var/log/zeek/conn.log --threshold 0.1

# Detect port scans
node agent.js scans /var/log/zeek/conn.log --scan-threshold 50
```
