Zeek CAPWAP packet analyzer

This repository contains a Zeek packet analyzer for the CAPWAP protocol. Mainly focus on data channel (port 5247). It is packed as a Zeek package, which can be easily installed with Zeek Package Manager.

The CAPWAP protocol is defined in the following RFCs:



Before trying to install the package, make sure you have the following tools installed:

Everything should be installed correctly if you install the latest Zeek version.


A simple call to make install from the repository's root directory should install the package and run unit tests. You can also use the zkg command directly:

zkg install https://github.com/AmazingPP/zeek-capwap  # to install as super user
zkg --user install https://github.com/AmazingPP/zeek-capwap  # to install in user space

You might have to update the ZEEKPATH and ZEEK_PLUGIN_PATH environmental variables. To see which value they should take, run the following commands:

zkg env         # For the super user
zkg --user env  # For a normal user

To confirm that installation was successful, you can run the following command:

zeek -NN | grep CAPWAP

If the command's output shows something similar to:


the package was correctly installed, and you have access to the CAPWAP packet analyzer.

In the case of any installation problems, please check the Zeek Package Manager documentation.


The plugin defines the following events:

  • event capwap_packet(outer: connection, inner: pkt_hdr)
    • Generated for any packet encapsulated in a CAPWAP tunnel.


This project is licensed under the BSD license. See the LICENSE file for details.


  • Fupeng Zhao
    • GitHub: @AmazingPP
    • Email: fupeng.zhao@foxmail.com

Package Version :