diff --git a/src/file_analysis/AnalyzerSet.cc b/src/file_analysis/AnalyzerSet.cc
index 2c4dc50189..3ea6f5f925 100644
--- a/src/file_analysis/AnalyzerSet.cc
+++ b/src/file_analysis/AnalyzerSet.cc
@@ -83,7 +83,7 @@ Analyzer* AnalyzerSet::QueueAdd(const file_analysis::Tag& tag, RecordVal* args)
 	if ( ! a )
 		{
 		delete key;
-		return 0;
+		return nullptr;
 		}
 
 	mod_queue.push(new AddMod(a, key));
@@ -184,7 +184,7 @@ file_analysis::Analyzer* AnalyzerSet::InstantiateAnalyzer(const Tag& tag,
 		reporter->Error("[%s] Failed file analyzer %s instantiation",
 		                file->GetID().c_str(),
 		                file_mgr->GetComponentName(tag).c_str());
-		return 0;
+		return nullptr;
 		}
 
 	return a;
diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc
index 045c5c8026..b526fdd80c 100644
--- a/src/file_analysis/File.cc
+++ b/src/file_analysis/File.cc
@@ -82,7 +82,7 @@ void File::StaticInit()
 
 File::File(const string& file_id, const string& source_name, Connection* conn,
            analyzer::Tag tag, bool is_orig)
-	: id(file_id), val(0), file_reassembler(0), stream_offset(0),
+	: id(file_id), val(nullptr), file_reassembler(nullptr), stream_offset(0),
 	  reassembly_max_buffer(0), did_metadata_inference(false),
 	  reassembly_enabled(false), postpone_timeout(false), done(false),
 	  analyzers(this)
@@ -260,7 +260,7 @@ bool File::AddAnalyzer(file_analysis::Tag tag, RecordVal* args)
 	if ( done )
 		return false;
 
-	return analyzers.QueueAdd(tag, args) != 0;
+	return analyzers.QueueAdd(tag, args) != nullptr;
 	}
 
 bool File::RemoveAnalyzer(file_analysis::Tag tag, RecordVal* args)
@@ -280,7 +280,7 @@ void File::DisableReassembly()
 	{
 	reassembly_enabled = false;
 	delete file_reassembler;
-	file_reassembler = 0;
+	file_reassembler = nullptr;
 	}
 
 void File::SetReassemblyBuffer(uint64_t max)
@@ -386,7 +386,7 @@ void File::DeliverStream(const u_char* data, uint64_t len)
 	        fmt_bytes((const char*) data, min((uint64_t)40, len)),
 	        len > 40 ? "..." : "");
 
-	file_analysis::Analyzer* a = 0;
+	file_analysis::Analyzer* a = nullptr;
 	IterCookie* c = analyzers.InitForIteration();
 
 	while ( (a = analyzers.NextEntry(c)) )
@@ -490,7 +490,7 @@ void File::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset)
 	        fmt_bytes((const char*) data, min((uint64_t)40, len)),
 	        len > 40 ? "..." : "");
 
-	file_analysis::Analyzer* a = 0;
+	file_analysis::Analyzer* a = nullptr;
 	IterCookie* c = analyzers.InitForIteration();
 
 	while ( (a = analyzers.NextEntry(c)) )
@@ -554,7 +554,7 @@ void File::EndOfFile()
 
 	done = true;
 
-	file_analysis::Analyzer* a = 0;
+	file_analysis::Analyzer* a = nullptr;
 	IterCookie* c = analyzers.InitForIteration();
 
 	while ( (a = analyzers.NextEntry(c)) )
@@ -587,7 +587,7 @@ void File::Gap(uint64_t offset, uint64_t len)
 		DeliverStream((const u_char*) "", 0);
 		}
 
-	file_analysis::Analyzer* a = 0;
+	file_analysis::Analyzer* a = nullptr;
 	IterCookie* c = analyzers.InitForIteration();
 
 	while ( (a = analyzers.NextEntry(c)) )
diff --git a/src/file_analysis/File.h b/src/file_analysis/File.h
index 3b0f06e6f4..ee9c447278 100644
--- a/src/file_analysis/File.h
+++ b/src/file_analysis/File.h
@@ -236,7 +236,7 @@ protected:
 	 *        of the connection to the responder.  False indicates the other
 	 *        direction.
 	 */
-	File(const string& file_id, const string& source_name, Connection* conn = 0,
+	File(const string& file_id, const string& source_name, Connection* conn = nullptr,
 	     analyzer::Tag tag = analyzer::Tag::Error, bool is_orig = false);
 
 	/**
diff --git a/src/file_analysis/FileReassembler.cc b/src/file_analysis/FileReassembler.cc
index ffc2fda54f..d42acb5301 100644
--- a/src/file_analysis/FileReassembler.cc
+++ b/src/file_analysis/FileReassembler.cc
@@ -13,7 +13,7 @@ FileReassembler::FileReassembler(File *f, uint64_t starting_offset)
 	}
 
 FileReassembler::FileReassembler()
-	: Reassembler(), the_file(0), flushing(false)
+	: Reassembler(), the_file(nullptr), flushing(false)
 	{
 	}
 
diff --git a/src/file_analysis/Manager.cc b/src/file_analysis/Manager.cc
index 72a1a5b079..9383041394 100644
--- a/src/file_analysis/Manager.cc
+++ b/src/file_analysis/Manager.cc
@@ -16,8 +16,8 @@
 
 using namespace file_analysis;
 
-TableVal* Manager::disabled = 0;
-TableType* Manager::tag_set_type = 0;
+TableVal* Manager::disabled = nullptr;
+TableType* Manager::tag_set_type = nullptr;
 string Manager::salt;
 
 Manager::Manager()
@@ -159,7 +159,7 @@ string Manager::DataIn(const u_char* data, uint64_t len, const analyzer::Tag& ta
 void Manager::DataIn(const u_char* data, uint64_t len, const string& file_id,
                      const string& source)
 	{
-	File* file = GetFile(file_id, 0, analyzer::Tag::Error, false, false,
+	File* file = GetFile(file_id, nullptr, analyzer::Tag::Error, false, false,
 	                     source.c_str());
 
 	if ( ! file )
@@ -306,10 +306,10 @@ File* Manager::GetFile(const string& file_id, Connection* conn,
                        const char* source_name)
 	{
 	if ( file_id.empty() )
-		return 0;
+		return nullptr;
 
 	if ( IsIgnored(file_id) )
-		return 0;
+		return nullptr;
 
 	File* rval = LookupFile(file_id);
 
@@ -334,7 +334,7 @@ File* Manager::GetFile(const string& file_id, Connection* conn,
 		rval->RaiseFileOverNewConnection(conn, is_orig);
 
 		if ( IsIgnored(file_id) )
-			return 0;
+			return nullptr;
 		}
 	else
 		{
@@ -466,14 +466,14 @@ Analyzer* Manager::InstantiateAnalyzer(const Tag& tag, RecordVal* args, File* f)
 		reporter->InternalWarning(
 		            "unknown file analyzer instantiation request: %s",
 		            tag.AsString().c_str());
-		return 0;
+		return nullptr;
 		}
 
 	if ( ! c->Factory() )
 		{
 		reporter->InternalWarning("file analyzer %s cannot be instantiated "
 					  "dynamically", c->CanonicalName().c_str());
-		return 0;
+		return nullptr;
 		}
 
 	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Instantiate analyzer %s",
diff --git a/src/file_analysis/Manager.h b/src/file_analysis/Manager.h
index 02da6aa182..6eb23acf73 100644
--- a/src/file_analysis/Manager.h
+++ b/src/file_analysis/Manager.h
@@ -358,10 +358,10 @@ protected:
 	 *         exist, the activity time is refreshed along with any
 	 *         connection-related fields.
 	 */
-	File* GetFile(const string& file_id, Connection* conn = 0,
+	File* GetFile(const string& file_id, Connection* conn = nullptr,
 	              const analyzer::Tag& tag = analyzer::Tag::Error,
 	              bool is_orig = false, bool update_conn = true,
-	              const char* source_name = 0);
+	              const char* source_name = nullptr);
 
 	/**
 	 * Evaluate timeout policy for a file and remove the File object mapped to
diff --git a/src/file_analysis/analyzer/data_event/DataEvent.cc b/src/file_analysis/analyzer/data_event/DataEvent.cc
index 4277ee1dda..7c669288fb 100644
--- a/src/file_analysis/analyzer/data_event/DataEvent.cc
+++ b/src/file_analysis/analyzer/data_event/DataEvent.cc
@@ -24,7 +24,7 @@ file_analysis::Analyzer* DataEvent::Instantiate(RecordVal* args, File* file)
 	auto chunk_val = args->Lookup("chunk_event");
 	auto stream_val = args->Lookup("stream_event");
 
-	if ( ! chunk_val && ! stream_val ) return 0;
+	if ( ! chunk_val && ! stream_val ) return nullptr;
 
 	EventHandlerPtr chunk;
 	EventHandlerPtr stream;
diff --git a/src/file_analysis/analyzer/extract/Extract.cc b/src/file_analysis/analyzer/extract/Extract.cc
index 2a4a5a54f7..203b201635 100644
--- a/src/file_analysis/analyzer/extract/Extract.cc
+++ b/src/file_analysis/analyzer/extract/Extract.cc
@@ -48,7 +48,7 @@ file_analysis::Analyzer* Extract::Instantiate(RecordVal* args, File* file)
 	auto limit = get_extract_field_val(args, "extract_limit");
 
 	if ( ! fname || ! limit )
-		return 0;
+		return nullptr;
 
 	return new Extract(args, file, fname->AsString()->CheckString(),
 	                   limit->AsCount());
diff --git a/src/file_analysis/analyzer/hash/Hash.h b/src/file_analysis/analyzer/hash/Hash.h
index f9ca8f8c63..903fc7d6f7 100644
--- a/src/file_analysis/analyzer/hash/Hash.h
+++ b/src/file_analysis/analyzer/hash/Hash.h
@@ -84,7 +84,7 @@ public:
 	 *         handler for the "file_hash" event.
 	 */
 	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file)
-		{ return file_hash ? new MD5(args, file) : 0; }
+		{ return file_hash ? new MD5(args, file) : nullptr; }
 
 protected:
 
@@ -112,7 +112,7 @@ public:
 	 *         handler for the "file_hash" event.
 	 */
 	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file)
-		{ return file_hash ? new SHA1(args, file) : 0; }
+		{ return file_hash ? new SHA1(args, file) : nullptr; }
 
 protected:
 
@@ -140,7 +140,7 @@ public:
 	 *         handler for the "file_hash" event.
 	 */
 	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file)
-		{ return file_hash ? new SHA256(args, file) : 0; }
+		{ return file_hash ? new SHA256(args, file) : nullptr; }
 
 protected:
 
diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc
index 6085bbdf6a..b990d0511c 100644
--- a/src/file_analysis/analyzer/x509/X509.cc
+++ b/src/file_analysis/analyzer/x509/X509.cc
@@ -257,8 +257,8 @@ X509_STORE* file_analysis::X509::GetRootStore(TableVal* root_certs)
 		::X509* x = d2i_X509(NULL, &data, sv->Len());
 		if ( ! x )
 			{
-			builtin_error(fmt("Root CA error: %s", ERR_error_string(ERR_get_error(),NULL)));
-			return 0;
+			builtin_error(fmt("Root CA error: %s", ERR_error_string(ERR_get_error(), NULL)));
+			return nullptr;
 			}
 
 		X509_STORE_add_cert(ctx, x);
@@ -339,10 +339,10 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 		return;
 		}
 
-	VectorVal* names = 0;
-	VectorVal* emails = 0;
-	VectorVal* uris = 0;
-	VectorVal* ips = 0;
+	VectorVal* names = nullptr;
+	VectorVal* emails = nullptr;
+	VectorVal* uris = nullptr;
+	VectorVal* ips = nullptr;
 
 	bool otherfields = false;
 
@@ -369,21 +369,21 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 			switch ( gen->type )
 				{
 				case GEN_DNS:
-					if ( names == 0 )
+					if ( names == nullptr )
 						names = new VectorVal(internal_type("string_vec")->AsVectorType());
 
 					names->Assign(names->Size(), bs);
 					break;
 
 				case GEN_URI:
-					if ( uris == 0 )
+					if ( uris == nullptr )
 						uris = new VectorVal(internal_type("string_vec")->AsVectorType());
 
 					uris->Assign(uris->Size(), bs);
 					break;
 
 				case GEN_EMAIL:
-					if ( emails == 0 )
+					if ( emails == nullptr )
 						emails = new VectorVal(internal_type("string_vec")->AsVectorType());
 
 					emails->Assign(emails->Size(), bs);
@@ -393,7 +393,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 
 		else if ( gen->type == GEN_IPADD )
 			{
-				if ( ips == 0 )
+				if ( ips == nullptr )
 					ips = new VectorVal(internal_type("addr_vec")->AsVectorType());
 
 				uint32_t* addr = (uint32_t*) gen->d.ip->data;
@@ -422,16 +422,16 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 
 		auto sanExt = make_intrusive<RecordVal>(BifType::Record::X509::SubjectAlternativeName);
 
-		if ( names != 0 )
+		if ( names != nullptr )
 			sanExt->Assign(0, names);
 
-		if ( uris != 0 )
+		if ( uris != nullptr )
 			sanExt->Assign(1, uris);
 
-		if ( emails != 0 )
+		if ( emails != nullptr )
 			sanExt->Assign(2, emails);
 
-		if ( ips != 0 )
+		if ( ips != nullptr )
 			sanExt->Assign(3, ips);
 
 		sanExt->Assign(4, val_mgr->GetBool(otherfields));
@@ -453,23 +453,23 @@ StringVal* file_analysis::X509::KeyCurve(EVP_PKEY *key)
 	if ( EVP_PKEY_base_id(key) != EVP_PKEY_EC )
 		{
 		// no EC-key - no curve name
-		return NULL;
+		return nullptr;
 		}
 
 	const EC_GROUP *group;
 	int nid;
 	if ( (group = EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(key))) == NULL )
 		// I guess we could not parse this
-		return NULL;
+		return nullptr;
 
 	nid = EC_GROUP_get_curve_name(group);
 	if ( nid == 0 )
 		// and an invalid nid...
-		return NULL;
+		return nullptr;
 
 	const char * curve_name = OBJ_nid2sn(nid);
-	if ( curve_name == NULL )
-		return NULL;
+	if ( curve_name == nullptr )
+		return nullptr;
 
 	return new StringVal(curve_name);
 #endif
@@ -560,7 +560,7 @@ IMPLEMENT_OPAQUE_VALUE(X509Val)
 
 broker::expected<broker::data> X509Val::DoSerialize() const
 	{
-	unsigned char *buf = NULL;
+	unsigned char *buf = nullptr;
 	int length = i2d_X509(certificate, &buf);
 
 	if ( length < 0 )
diff --git a/src/file_analysis/analyzer/x509/X509.h b/src/file_analysis/analyzer/x509/X509.h
index 54f32b49f8..fd9934bd80 100644
--- a/src/file_analysis/analyzer/x509/X509.h
+++ b/src/file_analysis/analyzer/x509/X509.h
@@ -86,7 +86,7 @@ public:
 	 * @param Returns the new record value and passes ownership to
 	 * caller.
 	 */
-	static RecordVal* ParseCertificate(X509Val* cert_val, File* file = 0);
+	static RecordVal* ParseCertificate(X509Val* cert_val, File* file = nullptr);
 
 	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file)
 		{ return new X509(args, file); }
diff --git a/src/file_analysis/analyzer/x509/X509Common.cc b/src/file_analysis/analyzer/x509/X509Common.cc
index 86ab607707..c560e2afdb 100644
--- a/src/file_analysis/analyzer/x509/X509Common.cc
+++ b/src/file_analysis/analyzer/x509/X509Common.cc
@@ -310,7 +310,7 @@ IntrusivePtr<StringVal> file_analysis::X509Common::GetExtensionFromBIO(BIO* bio,
 		ERR_error_string_n(ERR_get_error(), tmp, sizeof(tmp));
 		EmitWeird("x509_get_ext_from_bio", f, tmp);
 		BIO_free_all(bio);
-		return 0;
+		return nullptr;
 		}
 
 	if ( length == 0 )
@@ -327,7 +327,7 @@ IntrusivePtr<StringVal> file_analysis::X509Common::GetExtensionFromBIO(BIO* bio,
 		// because it's unclear the length value is very reliable.
 		reporter->Error("X509::GetExtensionFromBIO malloc(%d) failed", length);
 		BIO_free_all(bio);
-		return 0;
+		return nullptr;
 		}
 
 	BIO_read(bio, (void*) buffer, length);
diff --git a/src/file_analysis/analyzer/x509/X509Common.h b/src/file_analysis/analyzer/x509/X509Common.h
index f8f934093e..da3fe3a1c2 100644
--- a/src/file_analysis/analyzer/x509/X509Common.h
+++ b/src/file_analysis/analyzer/x509/X509Common.h
@@ -35,7 +35,7 @@ public:
 	 *
 	 * @return The X509 extension value.
 	 */
-	static IntrusivePtr<StringVal> GetExtensionFromBIO(BIO* bio, File* f = 0);
+	static IntrusivePtr<StringVal> GetExtensionFromBIO(BIO* bio, File* f = nullptr);
 
 	static double GetTimeFromAsn1(const ASN1_TIME* atime, File* f, Reporter* reporter);
 
diff --git a/src/file_analysis/analyzer/x509/functions.bif b/src/file_analysis/analyzer/x509/functions.bif
index bdea24a15c..9f5635122f 100644
--- a/src/file_analysis/analyzer/x509/functions.bif
+++ b/src/file_analysis/analyzer/x509/functions.bif
@@ -11,7 +11,7 @@
 #include <openssl/err.h>
 
 // construct an error record
-RecordVal* x509_result_record(uint64_t num, const char* reason, Val* chainVector = 0)
+RecordVal* x509_result_record(uint64_t num, const char* reason, Val* chainVector = nullptr)
 	{
 	RecordVal* rrecord = new RecordVal(BifType::Record::X509::Result);
 
@@ -542,7 +542,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
 
 	int result = X509_verify_cert(csc);
 
-	VectorVal* chainVector = 0;
+	VectorVal* chainVector = nullptr;
 
 	if ( result == 1 ) // we have a valid chain. try to get it...
 		{