No. 11 of 33 ·Network Packet Analyzer Software

Arkime

Web · Linux · Self-hosted · API

Freedom report

Two barsScore 6.4

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely2 of 6 device platforms
DocumentedPlans, terms and facts published

Arkime is ranked #11 of 33 in network packet analyzer software on Freedom251. It runs on API, Linux, Self-hosted, Web. There is a free plan.

Arkime plans and pricing

All plans

Arkime Free Open source · No paid-only features · No license fees arkime.com · 3 Oct 2026

Compared on network packet analyzer software

Free plan: Yes

Best Arkime alternatives

See all 12

Two bars NETCAP Free tier No. 1$548/mo6.6 Two bars PacketSafari Free tier No. 2Free6.6 Two bars Scapy Free tier No. 3Free6.6 Two bars NetworkMiner Free tier No. 4Free6.5 Two bars Sniffnet Free tier No. 5Free6.5 Two bars tcpdump Free tier No. 6Free6.5

The record

Purpose: Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records.
Session data: It parses layers 3–7 and indexes session fields such as protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch.
Packet capture: Arkime can store full packets in standard PCAP format or run as a metadata-only engine, with rules to select which traffic is saved.
Investigation: Users can search sessions, inspect packet data, and export search results as PCAP or CSV.
Cont3xt: Cont3xt enriches indicators from commercial and OSINT sources, including VirusTotal, Censys, and Shodan, and supports custom links and downloadable reports.
Supported indicators: Cont3xt auto-enriches supported IP, domain or hostname, URL, email, hash, and phone indicators, with phone enrichment limited to the U.S.
Parliament: Parliament groups Arkime clusters and displays cluster issues and Elasticsearch health.
Database requirement: Arkime requires OpenSearch or Elasticsearch to store network-session metadata.
Deployment: The installation guide covers Linux, recommends Debian or Ubuntu LTS, and also links to a container installation guide.
Scale: Arkime can scale capture horizontally by adding capture machines or vertically with more CPUs and disk.
Security: The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy.
Authentication: Arkime documents authentication modes including basic, form, digest, header, and OIDC, and warns that anonymous authentication is not recommended.
Security reporting: The project directs users to report security issues to Intigriti or [email protected].
Support: The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests.
Price from: Free

Where it ranks on Freedom251

Best Network Packet Analyzer Software in 2026#11 of 33
Best Network Protocol Analyzers in 2026#4 of 30
Best Digital Forensics Software in 2026#4 of 29
Best Network Packet Capture Software in 2026#8 of 20

Is Arkime yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Arkime

Sources

arkime.com· checked 3 Oct 2026
arkime.com/cont3xt· checked 3 Oct 2026
arkime.com/install· checked 3 Oct 2026
arkime.com/architecture· checked 3 Oct 2026
arkime.com/settings· checked 3 Oct 2026
arkime.com/questions· checked 3 Oct 2026
arkime.com/sponsor· checked 3 Oct 2026