Arkime

Overview

Arkime is an open-source system for turning passively observed network traffic into searchable session records. It is a strong fit for teams investigating traffic across their own networks that can run Linux capture infrastructure and an OpenSearch or Elasticsearch service. Its appeal is the choice between metadata-only operation and full-packet retention, without license fees; the trade-off is the infrastructure and security work that choice entails.

Key features

Arkime parses layers 3–7 and indexes session fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP. Investigators can search those records, inspect packet data, then export results as PCAP or CSV. That progression from filtering sessions to reviewing packets is useful for investigations, but the required OpenSearch or Elasticsearch database makes Arkime part of a larger system rather than a standalone analyzer.

Capture can save full packets in standard PCAP format or run in metadata-only mode, with rules to select which traffic is retained. This lets operators choose how much investigative detail to keep, but they must make and manage those retention decisions. Arkime supports remote capture, flow analysis, CLI tools, and both capture sources. It does not decrypt traffic, so it is a poor fit when decrypted payloads are a requirement.

Cont3xt enriches supported IP, domain or hostname, URL, email, hash, and phone indicators from commercial and OSINT sources, including VirusTotal, Censys, and Shodan. It also supports custom links and downloadable reports; phone enrichment is limited to the U.S. Parliament groups Arkime clusters and surfaces cluster issues and Elasticsearch health, giving operators a separate view of deployment status.

Pricing

Arkime is free: its Arkime plan costs nothing and is open source, with no license fees or paid-only features. That makes it accessible to teams able to supply and operate the required infrastructure. The free price does not remove the need to run OpenSearch or Elasticsearch, capture machines, and storage; those operational responsibilities are central to the cost decision.

Platforms

Arkime supports API access, Linux, self-hosted deployment, and a web interface. Its installation guide recommends Debian or Ubuntu LTS and also links to a container installation guide. Capture can scale horizontally by adding machines or vertically with more CPUs and disk, which gives operators two ways to respond as traffic demands grow.

Security configuration matters: the architecture guide recommends firewall restrictions on database and viewer ports and routing operator access through a central viewer, potentially behind a reverse proxy. Authentication modes include basic, form, digest, header, and OIDC; anonymous authentication is not recommended. The project provides a Slack workspace and office hours for questions, with GitHub Issues for bugs and feature requests, and directs security reports to Intigriti or [email protected].

Who it's for

Arkime suits security and network teams that need searchable session history and packet inspection, and have the skills to deploy and secure Linux capture systems alongside OpenSearch or Elasticsearch. Its configurable capture mode can serve teams prioritizing metadata or those that need PCAP retention. It is less suitable for organizations seeking a managed, self-contained viewer or traffic decryption.

Pros and cons

• Pros: Full PCAP or metadata-only capture, with rules for selecting retained traffic, lets teams tune investigative depth to their needs.
• Pros: Searchable layer 3–7 fields, packet inspection, and PCAP or CSV export support a practical investigation workflow.
• Pros: No license fees and no paid-only features keep software access unrestricted.
• Cons: OpenSearch or Elasticsearch is required for session metadata, adding a substantial dependency to deploy and maintain.
• Cons: Arkime does not decrypt traffic, excluding workflows that depend on decrypted payload analysis.
• Cons: Operators must handle capture, storage, database, and access security themselves.

Alternatives

For a broader directory of tools, browse Network Protocol Analyzers, Digital Forensics Software, Network Packet Capture Software, and Network Packet Analyzer Software.

• Scapy is a free option for teams working with Python 3.7+ that want a GPLv2 tool across Linux, macOS, Windows, web, API, or self-hosted environments.
• termshark is a free choice for users who want a MIT-licensed tool on desktop platforms and already have tshark 1.10.2 or higher.
• NETCAP may suit teams looking for an open-source CLI with 66+ audit record types and community support on its free Core plan; its Pro plan is $548 a month.
• NetworkMiner is another freemium option, with a free edition and GPLv2 source written in managed C# on .NET Framework.
• PacketSnitch is a paid product with a free plan and free trial for teams comparing another packet-analysis option.
• Ettercap is a free, open-source alternative.
• Kismet is a free and open-source alternative with no paid plan or usage limit stated.
• OpenGrep is a free open-source static analysis engine with a CLI.

Verdict

Choose Arkime if your team needs searchable network sessions, packet inspection, and control over packet retention, and can operate the Linux and OpenSearch or Elasticsearch infrastructure behind it. The lack of license fees and flexible capture are compelling; look elsewhere if you need traffic decryption or a system that does not depend on infrastructure you manage.