diff --git a/ci/ubuntu-22.10/Dockerfile b/ci/ubuntu-22.10/Dockerfile
index b34ae527a8..63f9ca2dd5 100644
--- a/ci/ubuntu-22.10/Dockerfile
+++ b/ci/ubuntu-22.10/Dockerfile
@@ -2,7 +2,7 @@ FROM ubuntu:22.10
 
 ENV DEBIAN_FRONTEND="noninteractive" TZ="America/Los_Angeles"
 
-# A version field to invalide Cirrus's build cache when needed, as suggested in
+# A version field to invalidate Cirrus's build cache when needed, as suggested in
 # https://github.com/cirruslabs/cirrus-ci-docs/issues/544#issuecomment-566066822
 ENV DOCKERFILE_VERSION 20230413
 
diff --git a/scripts/base/frameworks/cluster/nodes/logger.zeek b/scripts/base/frameworks/cluster/nodes/logger.zeek
index da4d892879..4b29d7654f 100644
--- a/scripts/base/frameworks/cluster/nodes/logger.zeek
+++ b/scripts/base/frameworks/cluster/nodes/logger.zeek
@@ -41,7 +41,7 @@ function archiver_encode_log_metadata(tbl: table[string] of string): string
 	local metadata_vec: vector of string;
 	for ( k, v in tbl )
 		{
-		if ( |v| == 0 )  # Assume concious decision to skip this entry.
+		if ( |v| == 0 )  # Assume conscious decision to skip this entry.
 			next;
 
 		if ( /[,=]/ in k || /[,=]/ in v )
diff --git a/scripts/base/frameworks/netcontrol/main.zeek b/scripts/base/frameworks/netcontrol/main.zeek
index 7d1d6a7976..4687c2d52d 100644
--- a/scripts/base/frameworks/netcontrol/main.zeek
+++ b/scripts/base/frameworks/netcontrol/main.zeek
@@ -167,7 +167,7 @@ export {
 	##
 	## For example, a search for 192.168.17.0/8 will reveal a rule that exists for
 	## 192.168.0.0/16, since this rule affects the subnet. However, it will not reveal
-	## a more specific rule for 192.168.17.1/32, which does not directy affect the whole
+	## a more specific rule for 192.168.17.1/32, which does not directly affect the whole
 	## subnet.
 	##
 	## This function works on both the manager and workers of a cluster. Note that on
diff --git a/scripts/base/frameworks/sumstats/plugins/hll_unique.zeek b/scripts/base/frameworks/sumstats/plugins/hll_unique.zeek
index 43cafcff7f..f1e4d23714 100644
--- a/scripts/base/frameworks/sumstats/plugins/hll_unique.zeek
+++ b/scripts/base/frameworks/sumstats/plugins/hll_unique.zeek
@@ -26,7 +26,7 @@ export {
 }
 
 redef record ResultVal += {
-	# Internal use only.  This is not meant to be publically available
+	# Internal use only.  This is not meant to be publicly available
 	# because probabilistic data structures have to be examined using
 	# specialized bifs.
 	card: opaque of cardinality &optional;
diff --git a/scripts/base/frameworks/sumstats/plugins/sample.zeek b/scripts/base/frameworks/sumstats/plugins/sample.zeek
index d5d236f43f..4a2c9e20bd 100644
--- a/scripts/base/frameworks/sumstats/plugins/sample.zeek
+++ b/scripts/base/frameworks/sumstats/plugins/sample.zeek
@@ -26,7 +26,7 @@ export {
 }
 
 redef record ResultVal += {
-	# Internal use only.  This is not meant to be publically available
+	# Internal use only.  This is not meant to be publicly available
 	# and just a copy of num_samples from the Reducer. Needed for
 	# availability in the compose hook.
 	num_samples: count &default=0;
diff --git a/scripts/base/frameworks/sumstats/plugins/unique.zeek b/scripts/base/frameworks/sumstats/plugins/unique.zeek
index 069522effb..dbcb4314a3 100644
--- a/scripts/base/frameworks/sumstats/plugins/unique.zeek
+++ b/scripts/base/frameworks/sumstats/plugins/unique.zeek
@@ -28,7 +28,7 @@ redef record ResultVal += {
 	# set in the reducer.
 	unique_max: count &optional;
 
-	# Internal use only.  This is not meant to be publically available
+	# Internal use only.  This is not meant to be publicly available
 	# because we don't want to trust that we can inspect the values
 	# since we will likely move to a probabilistic data structure in the future.
 	# TODO: in the future this will optionally be a hyperloglog structure
diff --git a/scripts/base/utils/site.zeek b/scripts/base/utils/site.zeek
index 8aeb8f8296..e3e309da66 100644
--- a/scripts/base/utils/site.zeek
+++ b/scripts/base/utils/site.zeek
@@ -167,7 +167,7 @@ export {
 	global get_emails: function(a: addr): string;
 }
 
-# Please ignore, this is an interally used variable.
+# Please ignore, this is an internally used variable.
 global local_dns_suffix_regex: pattern = /MATCH_NOTHING/;
 global local_dns_neighbor_suffix_regex: pattern = /MATCH_NOTHING/;
 
diff --git a/scripts/policy/frameworks/spicy/resource-usage.zeek b/scripts/policy/frameworks/spicy/resource-usage.zeek
index d5daf8c404..e75176f2a4 100644
--- a/scripts/policy/frameworks/spicy/resource-usage.zeek
+++ b/scripts/policy/frameworks/spicy/resource-usage.zeek
@@ -1,4 +1,4 @@
-##! Logs Spicy-related resource usage continously for debugging purposes.
+##! Logs Spicy-related resource usage continuously for debugging purposes.
 
 module Spicy;
 
diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc
index 7093010421..1bbca1659b 100644
--- a/src/DNS_Mgr.cc
+++ b/src/DNS_Mgr.cc
@@ -1554,7 +1554,7 @@ TableValPtr DNS_Mgr::empty_addr_set()
 
 // Unit testing coverage for the DNS_Mgr code, including making actual DNS requests to
 // test responses and timeouts. Note that all of these tests are marked with the skip
-// decorator, since they take some time to run and this slows down local developement. To
+// decorator, since they take some time to run and this slows down local development. To
 // run them manually, pass the --no-skip flag when running tests. These tests are
 // run automatically as part of CI builds.
 
@@ -1605,7 +1605,7 @@ public:
 
 /**
  * Derived testing version of DNS_Mgr so that the Process() method can be exposed
- * publically. If new unit tests are added, this class should be used over using
+ * publicly. If new unit tests are added, this class should be used over using
  * DNS_Mgr directly.
  */
 class TestDNS_Mgr final : public DNS_Mgr
diff --git a/src/Debug.cc b/src/Debug.cc
index 78fb3b990b..ac03aceb35 100644
--- a/src/Debug.cc
+++ b/src/Debug.cc
@@ -485,7 +485,7 @@ int dbg_shutdown_debugger()
 // by the operation argument; the additional arguments are put in the
 // supplied vector.
 //
-// Parse the string into individual tokens, similarily to how shell
+// Parse the string into individual tokens, similarly to how shell
 // would do it.
 
 void tokenize(const char* cstr, string& operation, vector<string>& arguments)
diff --git a/src/Desc.h b/src/Desc.h
index d33b9bf03f..e907693da0 100644
--- a/src/Desc.h
+++ b/src/Desc.h
@@ -191,7 +191,7 @@ protected:
 	std::pair<const char*, size_t> FirstEscapeLoc(const char* bytes, size_t n);
 
 	/**
-	 * @param start start of string to check for starting with an espace
+	 * @param start start of string to check for starting with an escape
 	 *              sequence.
 	 * @param end one byte past the last character in the string.
 	 * @return The number of bytes in the escape sequence that the string
diff --git a/src/RE.h b/src/RE.h
index b56660399f..614524754b 100644
--- a/src/RE.h
+++ b/src/RE.h
@@ -167,7 +167,7 @@ public:
 
 	const AcceptingMatchSet& AcceptedMatches() const { return accepted_matches; }
 
-	// Returns the number of bytes feeded into the matcher so far
+	// Returns the number of bytes fed into the matcher so far
 	int Length() { return current_pos; }
 
 	// Returns true if this inputs leads to at least one new match.
diff --git a/src/Reporter.cc b/src/Reporter.cc
index 6815dbe4b2..1ae0c0335d 100644
--- a/src/Reporter.cc
+++ b/src/Reporter.cc
@@ -557,7 +557,7 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out, Conne
 
 	int size = sizeof(tmp);
 	char* buffer = tmp;
-	char* alloced = nullptr;
+	char* allocated = nullptr;
 
 	std::string loc_str;
 
@@ -621,7 +621,7 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out, Conne
 
 		// Enlarge buffer;
 		size *= 2;
-		buffer = alloced = (char*)realloc(alloced, size);
+		buffer = allocated = (char*)realloc(allocated, size);
 
 		if ( ! buffer )
 			FatalError("out of memory in Reporter");
@@ -740,8 +740,8 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out, Conne
 #endif
 		}
 
-	if ( alloced )
-		free(alloced);
+	if ( allocated )
+		free(allocated);
 	}
 
 bool Reporter::EmitToStderr(bool flag)
diff --git a/src/Stats.cc b/src/Stats.cc
index 5ac3c7b427..6ae3548596 100644
--- a/src/Stats.cc
+++ b/src/Stats.cc
@@ -178,7 +178,7 @@ void ProfileLogger::Log()
 	DNS_Mgr::Stats dstats;
 	dns_mgr->GetStats(&dstats);
 
-	file->Write(util::fmt("%.06f DNS_Mgr: requests=%lu succesful=%lu failed=%lu pending=%lu "
+	file->Write(util::fmt("%.06f DNS_Mgr: requests=%lu successful=%lu failed=%lu pending=%lu "
 	                      "cached_hosts=%lu cached_addrs=%lu\n",
 	                      run_state::network_time, dstats.requests, dstats.successful,
 	                      dstats.failed, dstats.pending, dstats.cached_hosts,
diff --git a/src/Stmt.h b/src/Stmt.h
index 5625b54502..e97570da5c 100644
--- a/src/Stmt.h
+++ b/src/Stmt.h
@@ -617,7 +617,7 @@ private:
 
 	bool is_return = false;
 
-	// The name of parameter passed ot the lambda.
+	// The name of parameter passed to the lambda.
 	std::string lambda_param_id;
 
 	// The expression for constructing the lambda, and its type.
diff --git a/src/Trigger.h b/src/Trigger.h
index e1c228fe33..71362ed511 100644
--- a/src/Trigger.h
+++ b/src/Trigger.h
@@ -92,7 +92,7 @@ public:
 
 	void Describe(ODesc* d) const override;
 
-	// Overidden from Notifier.  We queue the trigger and evaluate it
+	// Overridden from Notifier.  We queue the trigger and evaluate it
 	// later to avoid race conditions.
 	void Modified(zeek::notifier::detail::Modifiable* m) override;
 
diff --git a/src/Val.cc b/src/Val.cc
index a6d6fbfed5..102021c8a6 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -1375,7 +1375,7 @@ static std::variant<ValPtr, std::string> BuildVal(const rapidjson::Value& j, con
 			}
 
 		default:
-			return util::fmt("type '%s' unsupport", type_name(t->Tag()));
+			return util::fmt("type '%s' unsupported", type_name(t->Tag()));
 		}
 	}
 
@@ -2425,7 +2425,7 @@ void TableVal::SendToStore(const Val* index, const TableEntryVal* new_entry_val,
 					{
 					if ( attrs->Find(detail::ATTR_EXPIRE_CREATE) )
 						{
-						// for create expiry, we have to substract the already elapsed time from
+						// for create expiry, we have to subtract the already elapsed time from
 						// the expiry.
 						auto e = expire_time -
 						         (run_state::network_time - new_entry_val->ExpireAccessTime());
@@ -2720,7 +2720,7 @@ void TableVal::Describe(ODesc* d) const
 
 void TableVal::InitDefaultFunc(detail::Frame* f)
 	{
-	// Value aready initialized.
+	// Value already initialized.
 	if ( def_val )
 		return;
 
diff --git a/src/analyzer/Analyzer.h b/src/analyzer/Analyzer.h
index 6533841c95..639c971701 100644
--- a/src/analyzer/Analyzer.h
+++ b/src/analyzer/Analyzer.h
@@ -466,7 +466,7 @@ public:
 	Analyzer* GetChildAnalyzer(const zeek::Tag& tag) const;
 
 	/**
-	 * Recursively searches all (direct or indirect) childs of the
+	 * Recursively searches all (direct or indirect) children of the
 	 * analyzer for an analyzer with a specific ID.
 	 *
 	 * @param id The analyzer id to search. This is the ID that GetID()
@@ -477,7 +477,7 @@ public:
 	virtual Analyzer* FindChild(ID id);
 
 	/**
-	 * Recursively searches all (direct or indirect) childs of the
+	 * Recursively searches all (direct or indirect) children of the
 	 * analyzer for an analyzer of a given type.
 	 *
 	 * @param tag The analyzer type to search.
@@ -488,7 +488,7 @@ public:
 	virtual Analyzer* FindChild(zeek::Tag tag);
 
 	/**
-	 * Recursively searches all (direct or indirect) childs of the
+	 * Recursively searches all (direct or indirect) children of the
 	 * analyzer for an analyzer of a given type.
 	 *
 	 * @param name The name of the analyzer type to search (e.g.,
diff --git a/src/analyzer/Manager.h b/src/analyzer/Manager.h
index 5a1c23235f..599ba69f52 100644
--- a/src/analyzer/Manager.h
+++ b/src/analyzer/Manager.h
@@ -297,7 +297,7 @@ public:
 	 * @param init True if the newly added analyzers should be
 	 * immediately initialized.
 	 *
-	 * @param root If given, the scheduled analyzers will become childs
+	 * @param root If given, the scheduled analyzers will become children
 	 * of this; if not given the connection's root analyzer is used
 	 * instead.
 	 *
diff --git a/src/analyzer/protocol/dnp3/DNP3.cc b/src/analyzer/protocol/dnp3/DNP3.cc
index ae52c885e1..3f589aa616 100644
--- a/src/analyzer/protocol/dnp3/DNP3.cc
+++ b/src/analyzer/protocol/dnp3/DNP3.cc
@@ -66,13 +66,13 @@
 //     (excluding CRC fields) in the current DNP3 packet.
 //
 // Since "Len" is of size one byte, the largest length it can represent is
-// 255 bytes. The larget DNP3 Application Layer size is "255 - 5 + size of
+// 255 bytes. The largest DNP3 Application Layer size is "255 - 5 + size of
 // all CRC fields". "minus 5" is coming from the 5 bytes after "Len" field in
 // the DNP3 Link Layer, i.e. Ctrl Dest_LSB Dest_MSB Src_LSB Src_MSB Hence,
 // the largest size of a DNP3 Packet (DNP3 Data Link Layer : DNP3 Transport
 // Layer : DNP3 Application Layer) can only be 292 bytes.
 //
-// The "Len" field indicates the length of of a single chunk of DNP3 Psuedo
+// The "Len" field indicates the length of of a single chunk of DNP3 Pseudo
 // Application Layer data instead of the whole DNP3 Application Layer
 // Fragment. However, we can not know the whole length of the DNP3
 // Application Layer Fragment (which Binpac would normally need) until all
diff --git a/src/analyzer/protocol/dnp3/dnp3-objects.pac b/src/analyzer/protocol/dnp3/dnp3-objects.pac
index e96436341e..be3ac9fd82 100644
--- a/src/analyzer/protocol/dnp3/dnp3-objects.pac
+++ b/src/analyzer/protocol/dnp3/dnp3-objects.pac
@@ -775,7 +775,7 @@ type FrozenCounter16woFlag = record {
 
 # g21v11 and g21v12 are obsolete
 
-# Conter event g22
+# Counter event g22
 
 # g22v1
 type CounterEve32wFlag = record {
@@ -807,7 +807,7 @@ type CounterEve16wFlagTime = record {
 
 # g22v7 g22v8 obsolete
 
-# Conter event g23
+# Counter event g23
 
 # g23v1
 type FrozenCounterEve32wFlag = record {
diff --git a/src/analyzer/protocol/dns/DNS.h b/src/analyzer/protocol/dns/DNS.h
index 2f229785d1..bc67170260 100644
--- a/src/analyzer/protocol/dns/DNS.h
+++ b/src/analyzer/protocol/dns/DNS.h
@@ -72,7 +72,7 @@ enum RR_Type
 	TYPE_NSEC3 = 50,
 	TYPE_NSEC3PARAM = 51, ///< Contains the NSEC3 parameters (RFC 5155)
 	TYPE_SVCB =
-	64, ///< SerViCe Binding (RFC draft:
+	64, ///< Service Binding (RFC draft:
 	    ///< https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-https-07#section-1.1)
 	TYPE_HTTPS = 65, ///< HTTPS record (HTTPS specific SVCB resource record)
 	// Obsoleted
diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc
index 3465c796f3..1053c7b14f 100644
--- a/src/analyzer/protocol/http/HTTP.cc
+++ b/src/analyzer/protocol/http/HTTP.cc
@@ -1293,7 +1293,7 @@ int HTTP_Analyzer::HTTP_RequestLine(const char* line, const char* end_of_line)
 
 	// If we determined HTTP/0.9 (no HTTP/ in the request line), assert that
 	// minimally we have an URI and a 3 character method (HTTP 0.9 only
-	// supports GET). If that doesn't hold, probably not HTTP or very stange.
+	// supports GET). If that doesn't hold, probably not HTTP or very strange.
 	if ( request_version == HTTP_VersionNumber{0, 9} )
 		{
 		bool maybe_get_method = (end_of_method - line) >= 3;
diff --git a/src/analyzer/protocol/irc/IRC.cc b/src/analyzer/protocol/irc/IRC.cc
index f944b7e02a..6e721a2f5c 100644
--- a/src/analyzer/protocol/irc/IRC.cc
+++ b/src/analyzer/protocol/irc/IRC.cc
@@ -1079,7 +1079,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 
 void IRC_Analyzer::StartTLS()
 	{
-	// STARTTLS was succesful. Remove support analyzers, add SSL
+	// STARTTLS was successful. Remove support analyzers, add SSL
 	// analyzer, and throw event signifying the change.
 	starttls = true;
 
diff --git a/src/analyzer/protocol/irc/IRC.h b/src/analyzer/protocol/irc/IRC.h
index 0b58eeafd7..4d54c8bafa 100644
--- a/src/analyzer/protocol/irc/IRC.h
+++ b/src/analyzer/protocol/irc/IRC.h
@@ -72,7 +72,7 @@ private:
 	 * \brief Splits a string into its words which are separated by
 	 * the split character.
 	 *
-	 * \param input string which will be splitted
+	 * \param input string which will be split
 	 * \param split character which separates the words
 	 * \return vector containing words
 	 */
diff --git a/src/analyzer/protocol/mysql/mysql-protocol.pac b/src/analyzer/protocol/mysql/mysql-protocol.pac
index b19b216610..e8415e3de0 100644
--- a/src/analyzer/protocol/mysql/mysql-protocol.pac
+++ b/src/analyzer/protocol/mysql/mysql-protocol.pac
@@ -48,7 +48,7 @@ type LengthEncodedStringArg(first_byte: uint8) = record {
 		public:
 		int operator()(uint24le* num) const
 			{
-			// Convert 24bit little endian int parsed as 3 uint8 into host endianess.
+			// Convert 24bit little endian int parsed as 3 uint8 into host endianness.
 			return (num->byte1() << 16) | (num->byte2() << 8) | num->byte3();
 			}
 
diff --git a/src/analyzer/protocol/pop3/POP3.cc b/src/analyzer/protocol/pop3/POP3.cc
index 501cecaa56..2890225bb8 100644
--- a/src/analyzer/protocol/pop3/POP3.cc
+++ b/src/analyzer/protocol/pop3/POP3.cc
@@ -806,7 +806,7 @@ void POP3_Analyzer::ProcessReply(int length, const char* line)
 
 void POP3_Analyzer::StartTLS()
 	{
-	// STARTTLS was succesful. Remove support analyzers, add SSL
+	// STARTTLS was successful. Remove support analyzers, add SSL
 	// analyzer, and throw event signifying the change.
 	RemoveSupportAnalyzer(cl_orig);
 	RemoveSupportAnalyzer(cl_resp);
diff --git a/src/analyzer/protocol/rfb/events.bif b/src/analyzer/protocol/rfb/events.bif
index dd790d9a20..f55967ffaa 100644
--- a/src/analyzer/protocol/rfb/events.bif
+++ b/src/analyzer/protocol/rfb/events.bif
@@ -9,7 +9,7 @@ event rfb_authentication_type%(c: connection, authtype: count%);
 ##
 ## c: The connection record for the underlying transport-layer session/flow.
 ##
-## result: whether or not authentication was succesful
+## result: whether or not authentication was successful
 event rfb_auth_result%(c: connection, result: bool%);
 
 ## Generated for RFB event share flag messages
diff --git a/src/analyzer/protocol/rfb/rfb-protocol.pac b/src/analyzer/protocol/rfb/rfb-protocol.pac
index 3852a17e98..3c7a6ad0e8 100644
--- a/src/analyzer/protocol/rfb/rfb-protocol.pac
+++ b/src/analyzer/protocol/rfb/rfb-protocol.pac
@@ -224,8 +224,8 @@ type PixelData(encoding: int32, x: uint16, y: uint16, w: uint16, h: uint16) = ca
 	  15   -> trle: PD_TRLE;
 	  16   -> zrle: PD_ZRLE;
 	# TODO: binpac is not happy with negative values here
-	#-239   -> cursor_pseudo: PD_PsuedoCursor;
-	#-223   -> desktop_size: PD_PsuedoDesktopSize;
+	#-239   -> cursor_pseudo: PD_PseudoCursor;
+	#-223   -> desktop_size: PD_PseudoDesktopSize;
 };
 
 type PD_Raw(w: uint16, h: uint16) = record {
@@ -266,12 +266,12 @@ type PD_ZRLE = record {
 	zlib_data: bytestring &length=len &transient;
 } &length=(4 + len);
 
-type PD_PsuedoCursor(w: uint16, h: uint16) = record {
+type PD_PseudoCursor(w: uint16, h: uint16) = record {
 	pixels: bytestring &length=(w * h * $context.connection.get_bytes_per_pixel()) &transient;
 	bitmask: bytestring &length=(h * ((w + 7) / 8)) &transient;
 } &length=(w * h * $context.connection.get_bytes_per_pixel()) + (h * ((w + 7) / 8))
 
-type PD_PsuedoDesktopSize = record {
+type PD_PseudoDesktopSize = record {
 	# Actually no further data
 	nothing: empty;
 } &length=0;
diff --git a/src/analyzer/protocol/smtp/SMTP.cc b/src/analyzer/protocol/smtp/SMTP.cc
index c6f1c2d92f..dca03701cf 100644
--- a/src/analyzer/protocol/smtp/SMTP.cc
+++ b/src/analyzer/protocol/smtp/SMTP.cc
@@ -384,7 +384,7 @@ void SMTP_Analyzer::NewCmd(int cmd_code)
 
 void SMTP_Analyzer::StartTLS()
 	{
-	// STARTTLS was succesful. Remove SMTP support analyzers, add SSL
+	// STARTTLS was successful. Remove SMTP support analyzers, add SSL
 	// analyzer, and throw event signifying the change.
 	state = detail::SMTP_IN_TLS;
 	expect_sender = expect_recver = true;
diff --git a/src/analyzer/protocol/ssl/ssl-analyzer.pac b/src/analyzer/protocol/ssl/ssl-analyzer.pac
index 05badf63cc..768e7b2fdc 100644
--- a/src/analyzer/protocol/ssl/ssl-analyzer.pac
+++ b/src/analyzer/protocol/ssl/ssl-analyzer.pac
@@ -33,8 +33,8 @@ refine connection SSL_Conn += {
 
 			for ( unsigned int i = 0; i < cipher_suites.size(); ++i )
 				{
-				auto ciph = zeek::val_mgr->Count(cipher_suites[i]);
-				cipher_vec->Assign(i, ciph);
+				auto cipher = zeek::val_mgr->Count(cipher_suites[i]);
+				cipher_vec->Assign(i, std::move(cipher));
 				}
 
 			auto comp_vec = zeek::make_intrusive<zeek::VectorVal>(zeek::id::index_vec);
diff --git a/src/analyzer/protocol/ssl/ssl-protocol.pac b/src/analyzer/protocol/ssl/ssl-protocol.pac
index f291bf5551..5914bcaeda 100644
--- a/src/analyzer/protocol/ssl/ssl-protocol.pac
+++ b/src/analyzer/protocol/ssl/ssl-protocol.pac
@@ -91,10 +91,10 @@ type V2ServerHello(rec: SSLRecord) = record {
 	#cert_type : uint8;
 	server_version : uint16;
 	cert_len : uint16;
-	ciph_len : uint16;
+	ciphers_len : uint16;
 	conn_id_len : uint16;
 	cert_data : bytestring &length = cert_len;
-	ciphers : uint24[ciph_len/3];
+	ciphers : uint24[ciphers_len/3];
 	conn_id_data : bytestring &length = conn_id_len;
 } &let {
 	session_id_hit : uint8 = rec.head3;
diff --git a/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac b/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
index 251047dec6..825827b15c 100644
--- a/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
+++ b/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
@@ -56,8 +56,8 @@ refine connection Handshake_Conn += {
 
 			for ( unsigned int i = 0; i < cipher_suites.size(); ++i )
 				{
-				auto ciph = zeek::val_mgr->Count(cipher_suites[i]);
-				cipher_vec->Assign(i, ciph);
+				auto cipher = zeek::val_mgr->Count(cipher_suites[i]);
+				cipher_vec->Assign(i, std::move(cipher));
 				}
 
 			auto comp_vec = zeek::make_intrusive<zeek::VectorVal>(zeek::id::index_vec);
diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc
index 845bc9a4d8..40e8299d53 100644
--- a/src/file_analysis/File.cc
+++ b/src/file_analysis/File.cc
@@ -130,9 +130,9 @@ bool File::UpdateConnectionFields(Connection* conn, bool is_orig)
 
 	if ( ! conns )
 		{
-		auto ect = empty_connection_table();
-		conns = ect;
-		val->Assign(conns_idx, std::move(ect));
+		auto empty_conn_table = empty_connection_table();
+		conns = empty_conn_table;
+		val->Assign(conns_idx, std::move(empty_conn_table));
 		}
 
 	auto idx = get_conn_id_val(conn);
diff --git a/src/file_analysis/analyzer/x509/ocsp_events.bif b/src/file_analysis/analyzer/x509/ocsp_events.bif
index 0f839c0ee5..b23ea1d6e0 100644
--- a/src/file_analysis/analyzer/x509/ocsp_events.bif
+++ b/src/file_analysis/analyzer/x509/ocsp_events.bif
@@ -39,7 +39,7 @@ event ocsp_request_certificate%(f: fa_file, hashAlgorithm: string, issuerNameHas
 ##
 ## f: The file.
 ##
-## status: The status of the OCSP response (e.g. succesful, malformedRequest, tryLater).
+## status: The status of the OCSP response (e.g. successful, malformedRequest, tryLater).
 ##
 ## .. zeek:see:: ocsp_request ocsp_request_certificate
 ##              ocsp_response_bytes ocsp_response_certificate ocsp_extension
@@ -52,7 +52,7 @@ event ocsp_response_status%(f: fa_file, status: string%);
 ##
 ## f: The file.
 ##
-## status: The status of the OCSP response (e.g. succesful, malformedRequest, tryLater).
+## status: The status of the OCSP response (e.g. successful, malformedRequest, tryLater).
 ##
 ## version: Version of the OCSP response (typically - for version 1).
 ##
diff --git a/src/input/Manager.cc b/src/input/Manager.cc
index a8f1d2d94d..6db091ed53 100644
--- a/src/input/Manager.cc
+++ b/src/input/Manager.cc
@@ -653,7 +653,7 @@ bool Manager::CreateTableStream(RecordVal* fval)
 	if ( ! CheckErrorEventTypes(stream_name, error_event, true) )
 		return false;
 
-	vector<Field*> fieldsV; // vector, because we don't know the length beforehands
+	vector<Field*> fieldsV; // vector, because we don't know the length beforehand
 
 	bool status = (! UnrollRecordType(&fieldsV, idx, "", false));
 
diff --git a/src/iosource/PktDumper.h b/src/iosource/PktDumper.h
index 7171d9e239..81ded1cbff 100644
--- a/src/iosource/PktDumper.h
+++ b/src/iosource/PktDumper.h
@@ -83,7 +83,7 @@ public:
 	 *
 	 * @param pkt The packet to record.
 	 *
-	 * @return True if succesful, false otherwise (in which case \a
+	 * @return True if successful, false otherwise (in which case \a
 	 * Error() must have been called.)
 	 */
 	virtual bool Dump(const Packet* pkt) = 0;
diff --git a/src/iosource/PktSrc.h b/src/iosource/PktSrc.h
index 062ac5032b..c9e4975411 100644
--- a/src/iosource/PktSrc.h
+++ b/src/iosource/PktSrc.h
@@ -263,7 +263,7 @@ protected:
 		uint32_t netmask;
 
 		/**
-		 * True if the source is reading live inout, false for
+		 * True if the source is reading live input, false for
 		 * working offline.
 		 */
 		bool is_live;
diff --git a/src/iosource/pcap/Dumper.h b/src/iosource/pcap/Dumper.h
index 58bd169030..ce24ecba06 100644
--- a/src/iosource/pcap/Dumper.h
+++ b/src/iosource/pcap/Dumper.h
@@ -20,7 +20,7 @@ public:
 	PcapDumper(const std::string& path, bool append);
 	~PcapDumper() override;
 
-	static PktDumper* Instantiate(const std::string& path, bool appen);
+	static PktDumper* Instantiate(const std::string& path, bool append);
 
 protected:
 	// PktDumper interface.
diff --git a/src/logging/WriterFrontend.h b/src/logging/WriterFrontend.h
index 52b2a1ae58..b2c64a129b 100644
--- a/src/logging/WriterFrontend.h
+++ b/src/logging/WriterFrontend.h
@@ -198,7 +198,7 @@ protected:
 	bool initialized; // True if initialized.
 	bool buf; // True if buffering is enabled (default).
 	bool local; // True if logging locally.
-	bool remote; // True if loggin remotely.
+	bool remote; // True if logging remotely.
 
 	const char* name; // Descriptive name of the
 	WriterBackend::WriterInfo* info; // The writer information.
diff --git a/src/packet_analysis/protocol/ieee802_11/IEEE802_11.cc b/src/packet_analysis/protocol/ieee802_11/IEEE802_11.cc
index bd9d913f78..beb69b2616 100644
--- a/src/packet_analysis/protocol/ieee802_11/IEEE802_11.cc
+++ b/src/packet_analysis/protocol/ieee802_11/IEEE802_11.cc
@@ -41,7 +41,7 @@ bool IEEE802_11Analyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet*
 	if ( (fc_80211 >> 4) & 0x08 )
 		{
 		// Store off whether this is an A-MSDU header, which indicates that there are
-		// mulitple packets following the 802.11 header.
+		// multiple packets following the 802.11 header.
 		is_amsdu = (data[len_80211] & 0x80) == 0x80;
 
 		// Check for the protected bit. This means the data is encrypted and we can't
diff --git a/src/packet_analysis/protocol/ip/IP.cc b/src/packet_analysis/protocol/ip/IP.cc
index 1803122c27..705178883f 100644
--- a/src/packet_analysis/protocol/ip/IP.cc
+++ b/src/packet_analysis/protocol/ip/IP.cc
@@ -87,7 +87,7 @@ bool IPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
 			total_len = packet->cap_len - hdr_size;
 		else
 			// If this is caused by segmentation offloading, the checksum will
-			// also be incorrect. If checksum validation is enabled - jus tbail here.
+			// also be incorrect. If checksum validation is enabled - just bail here.
 			return false;
 		}
 
diff --git a/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc b/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc
index f8f400ad3e..2a3d671efc 100644
--- a/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc
+++ b/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc
@@ -1356,7 +1356,7 @@ void TCPSessionAdapter::ConnectionClosed(analyzer::tcp::TCP_Endpoint* endpoint,
 	const analyzer::analyzer_list& children(GetChildren());
 	LOOP_OVER_CONST_CHILDREN(i)
 	// Using this type of cast here is nasty (will crash if
-	// we inadvertantly have a child analyzer that's not a
+	// we inadvertently have a child analyzer that's not a
 	// TCP_ApplicationAnalyzer), but we have to ...
 	static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(*i)->ConnectionClosed(endpoint, peer,
 	                                                                           gen_event);
diff --git a/src/probabilistic/CardinalityCounter.h b/src/probabilistic/CardinalityCounter.h
index e3f97b7b33..9650e207fb 100644
--- a/src/probabilistic/CardinalityCounter.h
+++ b/src/probabilistic/CardinalityCounter.h
@@ -136,7 +136,7 @@ private:
 	 * Define x = 2*(log(1.04*k/error)/log(2)). Then b is the ceiling of x.
 	 *
 	 * After that initial estimate, the value of b is increased until the
-	 * standard deviation falls within the specified valud.
+	 * standard deviation falls within the specified value.
 	 *
 	 * @param error error margin
 	 *
diff --git a/src/script_opt/CPP/DeclFunc.cc b/src/script_opt/CPP/DeclFunc.cc
index f46fe6b76c..12bedf82b2 100644
--- a/src/script_opt/CPP/DeclFunc.cc
+++ b/src/script_opt/CPP/DeclFunc.cc
@@ -146,7 +146,7 @@ void CPPCompile::DeclareSubclass(const FuncTypePtr& ft, const ProfileFunc* pf, c
 	Emit("%s_cl(const char* name%s) : CPPStmt(name, %s)%s { }", fname, addl_args, loc_info, inits);
 
 	// An additional constructor just used to generate place-holder
-	// instances, due to the mis-design that lambdas are identified
+	// instances, due to the misdesign that lambdas are identified
 	// by their Func objects rather than their FuncVal objects.
 	if ( lambda_ids && lambda_ids->length() > 0 )
 		Emit("%s_cl(const char* name) : CPPStmt(name, %s) { }", fname, loc_info);
diff --git a/src/script_opt/Expr.cc b/src/script_opt/Expr.cc
index c8ef874880..b2e9880056 100644
--- a/src/script_opt/Expr.cc
+++ b/src/script_opt/Expr.cc
@@ -414,7 +414,7 @@ ExprPtr Expr::AssignToTemporary(ExprPtr e, Reducer* c, StmtPtr& red_stmt)
 
 	// Important: our result is not result_tmp, but a duplicate of it.
 	// This is important because subsequent passes that associate
-	// information with Expr's need to not mis-associate that
+	// information with Expr's need to not misassociate that
 	// information with both the assignment creating the temporary,
 	// and the subsequent use of the temporary.
 	return result_tmp->Duplicate();
diff --git a/src/script_opt/IDOptInfo.h b/src/script_opt/IDOptInfo.h
index a55f5791a8..df076f1b36 100644
--- a/src/script_opt/IDOptInfo.h
+++ b/src/script_opt/IDOptInfo.h
@@ -59,10 +59,10 @@ public:
 	// (= more inner) block level.
 	int BlockLevel() const { return block_level; }
 
-	// True if in the region the identifer could be defined.
+	// True if in the region the identifier could be defined.
 	bool MaybeDefined() const { return maybe_defined; }
 
-	// Returns (or sets) the statement after which the identifer is
+	// Returns (or sets) the statement after which the identifier is
 	// (definitely) defined, or NO_DEF if it doesn't have a definite
 	// point of definition.
 	int DefinedAfter() const { return defined; }
@@ -198,7 +198,7 @@ public:
 	// the block.
 	void ConfluenceBlockEndsAfter(const Stmt* s, bool no_orig_flow);
 
-	// All of these regard the identifer's state just *prior* to
+	// All of these regard the identifier's state just *prior* to
 	// executing the given statement.
 	bool IsPossiblyDefinedBefore(const Stmt* s);
 	bool IsDefinedBefore(const Stmt* s);
diff --git a/src/script_opt/ProfileFunc.h b/src/script_opt/ProfileFunc.h
index cc2605d1ec..07d56ef39e 100644
--- a/src/script_opt/ProfileFunc.h
+++ b/src/script_opt/ProfileFunc.h
@@ -3,7 +3,7 @@
 // Classes for traversing functions and their body ASTs to build up profiles
 // of the various elements (types, globals, locals, lambdas, etc.) that appear.
 // These profiles enable script optimization to make decisions regarding
-// compilability and how to efficiently provide run-time components.
+// compatibility and how to efficiently provide run-time components.
 // For all of the following, we use the term "function" to refer to a single
 // ScriptFunc/body pair, so an event handler or hook with multiple bodies
 // is treated as multiple distinct "function"'s.
diff --git a/src/script_opt/ScriptOpt.h b/src/script_opt/ScriptOpt.h
index 13fb7966c3..f262149a37 100644
--- a/src/script_opt/ScriptOpt.h
+++ b/src/script_opt/ScriptOpt.h
@@ -43,7 +43,7 @@ struct AnalyOpt
 	// Whether to analyze scripts.
 	bool activate = false;
 
-	// If true, compile all compileable functions, even those that
+	// If true, compile all compilable functions, even those that
 	// are inlined.  Mainly useful for ensuring compatibility for
 	// some tests in the test suite.
 	bool compile_all = false;
diff --git a/src/script_opt/ZAM/Ops.in b/src/script_opt/ZAM/Ops.in
index b6b09c7645..5d0fbac349 100644
--- a/src/script_opt/ZAM/Ops.in
+++ b/src/script_opt/ZAM/Ops.in
@@ -438,7 +438,7 @@ macro EvalCast(rhs)
 	else
 		ZAM_run_time_error(z.loc, error.c_str());
 
-# Cast an "any" type to the given type.  Only needed for type-based swith
+# Cast an "any" type to the given type.  Only needed for type-based switch
 # statements.
 internal-op Cast-Any
 type VV
diff --git a/src/spicy/manager.cc b/src/spicy/manager.cc
index 4c36a8c256..37300e75bf 100644
--- a/src/spicy/manager.cc
+++ b/src/spicy/manager.cc
@@ -201,7 +201,7 @@ void Manager::registerPacketAnalyzer(const std::string& name, const std::string&
     ::zeek::detail::zeekygen_mgr->Script(info.name_zeekygen);
     ::zeek::detail::set_location(makeLocation(info.name_zeekygen));
 
-    // TODO: Should Zeek do this? It has run component intialization at
+    // TODO: Should Zeek do this? It has run component initialization at
     // this point already, so ours won't get initialized anymore.
     c->Initialize();
 
diff --git a/src/spicy/spicyz/main.cc b/src/spicy/spicyz/main.cc
index 3945dfe7d8..015e37e2a3 100644
--- a/src/spicy/spicyz/main.cc
+++ b/src/spicy/spicyz/main.cc
@@ -30,7 +30,7 @@ static struct option long_driver_options[] = {{"abort-on-exceptions", required_a
                                               {"output-c++-files", no_argument, nullptr, 'x'},
                                               {"print-module-path", no_argument, nullptr, 'M'},
                                               {"print-plugin-path", no_argument, nullptr,
-                                               'P'}, // for backwards compatiblity
+                                               'P'}, // for backwards compatibility
                                               {"print-prefix-path", no_argument, nullptr, 'p'},
                                               {"print-zeek-config", no_argument, nullptr, 'z'},
                                               {"report-times", required_argument, nullptr, 'R'},
diff --git a/src/strings.bif b/src/strings.bif
index 1144bae14f..0c280c58ac 100644
--- a/src/strings.bif
+++ b/src/strings.bif
@@ -409,7 +409,7 @@ function split_string%(str: string, re: pattern%): string_vec
 ## re: The pattern describing the separator to split *str* in two pieces.
 ##
 ## Returns: An array of strings with two elements in which the first represents
-##          the substring in *str* up to the first occurence of *re*, and the
+##          the substring in *str* up to the first occurrence of *re*, and the
 ##          second everything after *re*. An array of one string is returned
 ##          when *s* cannot be split.
 ##
@@ -474,7 +474,7 @@ function split_string_n%(str: string, re: pattern,
 ##
 ## repl: The string that replaces *re*.
 ##
-## Returns: A copy of *str* with the first occurence of *re* replaced with
+## Returns: A copy of *str* with the first occurrence of *re* replaced with
 ##          *repl*.
 ##
 ## .. zeek:see:: gsub subst_string
diff --git a/src/supervisor/Supervisor.h b/src/supervisor/Supervisor.h
index 5147ecbea1..8e0cdca4ae 100644
--- a/src/supervisor/Supervisor.h
+++ b/src/supervisor/Supervisor.h
@@ -159,7 +159,7 @@ public:
 		// "scripts" field. It can go when we remove that deprecation.
 		NodeConfig() = default;
 #ifndef _MSC_VER
-		// MSVC throws this error when specifing this constructor:
+		// MSVC throws this error when specifying this constructor:
 		// error C2580: multiple versions of a defaulted special member functions are not allowed
 		NodeConfig(NodeConfig&) = default;
 #endif
diff --git a/src/threading/MsgThread.h b/src/threading/MsgThread.h
index c92a935b56..1d25d50d66 100644
--- a/src/threading/MsgThread.h
+++ b/src/threading/MsgThread.h
@@ -232,7 +232,7 @@ protected:
 	 *
 	 * This is method is called regularly by the threading::Manager.
 	 *
-	 * @return The message, wth ownership passed to caller. Returns null
+	 * @return The message, with ownership passed to caller. Returns null
 	 * if the queue is empty.
 	 */
 	BasicOutputMessage* RetrieveOut();
@@ -298,7 +298,7 @@ private:
 	 *
 	 * Must only be called by the child thread.
 	 *
-	 * @return The message, wth ownership passed to caller. Returns null
+	 * @return The message, with ownership passed to caller. Returns null
 	 * if the queue is empty.
 	 */
 	BasicInputMessage* RetrieveIn();
diff --git a/src/threading/SerialTypes.h b/src/threading/SerialTypes.h
index c463e7cecd..1b29f44761 100644
--- a/src/threading/SerialTypes.h
+++ b/src/threading/SerialTypes.h
@@ -138,7 +138,7 @@ struct Value
 
 	// A small note for handling subnet values: Subnet values emitted from
 	// the logging framework will always have a length that is based on the
-	// internal IPv6 representation (so you have to substract 96 from it to
+	// internal IPv6 representation (so you have to subtract 96 from it to
 	// get the correct value for IPv4).
 	// However, the Input framework expects the "normal" length for an IPv4
 	// address (so do not add 96 to it), because the underlying constructors
diff --git a/src/util.h b/src/util.h
index d08a819488..fda04cc899 100644
--- a/src/util.h
+++ b/src/util.h
@@ -363,7 +363,7 @@ extern const char* strpbrk_n(size_t len, const char* s, const char* charset);
 int strstr_n(const int big_len, const unsigned char* big, const int little_len,
              const unsigned char* little);
 
-// Replaces all occurences of *o* in *s* with *n*.
+// Replaces all occurrences of *o* in *s* with *n*.
 extern std::string strreplace(const std::string& s, const std::string& o, const std::string& n);
 
 // Remove all leading and trailing white space from string.