https://yacin.nadji.us/tags/packages/Recent content in packages on Yacin Nadji, Ph.D.Hugo -- gohugo.ioenSun, 23 Aug 2026 00:00:00 +0000https://yacin.nadji.us/posts/2026/08/the-cure-for-exceptional-zeek-package-testing-part-1/Sun, 23 Aug 2026 00:00:00 +0000https://yacin.nadji.us/posts/2026/08/the-cure-for-exceptional-zeek-package-testing-part-1/This article was originally posted on Zeek’s blog. Introduction As someone who ships a lot of Zeek packages to production, I’m always looking for ways to improve package testing. In the common, simple case, you have a small PCAP that exercises the behavior you need to generate your log or Notice and you can write a simple btest for it. But what if our case isn’t so simple? Perhaps a PCAP isn’t available or cannot be shared.https://yacin.nadji.us/posts/2026/08/the-cure-for-exceptional-zeek-package-testing-part-2/Sun, 23 Aug 2026 00:00:00 +0000https://yacin.nadji.us/posts/2026/08/the-cure-for-exceptional-zeek-package-testing-part-2/This article was originally posted on Zeek’s blog. Introduction In the previous blog in our series, we presented our motivational package, ip-distance, and how you can easily write unit tests with BTest. This works great for smaller auxiliary functions that aren’t necessary driven by network traffic, but what if a PCAP to drive our tests isn’t available or can’t be shared along with the code? In this part of the blog series, we’ll cover #2 and #3 in the list below:https://yacin.nadji.us/posts/2026/08/the-cure-for-exceptional-zeek-package-testing-part-3/Sun, 23 Aug 2026 00:00:00 +0000https://yacin.nadji.us/posts/2026/08/the-cure-for-exceptional-zeek-package-testing-part-3/This article was originally posted on Zeek’s blog. Introduction Back in Part 1 and Part 2, we presented our motivational package, ip-distance, how you can easily write unit tests in BTest, and how you can generate events—either by hand or through Zeek’s event tracing utility—to test your Zeek content. However, there’s another case I’d like to cover where you can use Zeek’s ability to read its own logs using the Input framework to exercise your package’s functionality.