More than 20 years ago I chose the name “Bro” as “an Orwellian reminder that monitoring comes hand in hand with the potential for privacy violations”, as the original Bro paper put it. Today that warning is needed more than ever … but it’s clear that now the name “Bro” is alas much more of a distraction than a reminder.

On the Leadership Team of the Bro Project, we heard clear concerns from the Bro community that the name “Bro” has taken on strongly negative connotations, such as “Bro culture”. These send a sharp, anti-inclusive – and wholly unintended and undesirable – message to those who might use Bro. The problems were significant enough that during BroCon community sessions, several people have mentioned substantial difficulties in getting their upper management to even consider using open-source software with such a seemingly ill-chosen, off-putting name.

Accordingly, in 2017 the Leadership Team undertook to find a new name for the project. We solicited suggestions for new names from the Bro community, receiving several hundred that covered a wide range of sensibilities and rationales. The LT extensively discussed the candidates internally but was unable to come close to a consensus on a satisfactory choice. Names that some LT members quite liked, others found quite deficient. This process proved particularly hard because some well-liked names had trademark issues and such.

Given that impasse, the LT engaged with a professional naming/branding consultancy to identify other possible names. The process elicited reflection on just what we would like the name to convey, which included notions of insight/visibility, soundness, flexibility, and Bro’s heritage.

As the process proceeded, a number of LT members identified their fondness for quirky, pithy names for open-source projects. One name in particular dates all the way back to the very beginning of Bro in 1995 at the Lawrence Berkeley National Laboratory: Zeek. At LBL, the production Bro monitoring ran as a pseudo-user named “zeek” – this included both running the Bro process itself, and also the batch jobs and parallel tcpdump captures used to ensure robust 24×7 operation – a usage that continued for decades.

Why Zeek? The name was inspired by Gary Larson’s use of Zeek characters in various “The Far Side” cartoons. We were big Far Side fans at LBL!

As Bro’s originator, I have to say that I find switching the system’s name to Zeek not only timely, but – in its quirkiness and history – endearing. I am thrilled that the Leadership Team identified and subsequently strongly backed the choice. (It was great, too, to find that we could secure the domain zeek.org.)

The name “Bro” offered numerous opportunities for modest-but-memorable wordplay, such as referring to the project’s “Broadmap”, beginning conferences with a “Broverview”, and coining the term “brogrammer”. We’ve only begun exploring the possibilities with Zeek. However, the speed with which we readily found our first slogan holds promise in this regard. In looking for a new name, we had particularly identified wanting to find one that underscores the system’s ability to provide deep insight into network traffic. We put that goal aside for our final selection. But shortly after we settled on our choice, a project member offered:

Zeek, and ye shall find!

Discover more from Zeek

Subscribe now to keep reading and get access to the full archive.

Continue reading