Arkime
What it is
Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable records. It parses layers 3–7 and indexes fields such as protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can retain full packets in standard PCAP format or run metadata-only capture, using rules to choose traffic for storage. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone-number enrichment is limited to the U.S. Parliament groups clusters and displays issues and Elasticsearch health. Capture capacity can grow by adding machines or increasing CPU and disk. Arkime supports Linux and self-hosted deployment; its installation guidance recommends Debian or Ubuntu LTS and links to a container guide. OpenSearch or Elasticsearch is required for session metadata.
For and against
For
- Can retain full packets in PCAP format.
- Supports metadata-only capture with traffic selection rules.
- Search results can be exported as PCAP or CSV.
- Capture can scale with added machines or resources.
- Free with no license fees or paid-only features.
Against
- Requires OpenSearch or Elasticsearch for session metadata.
- Installation guidance is Linux-focused.
- Phone indicator enrichment is limited to the U.S.
- Anonymous authentication is not recommended.
The verdict
Arkime offers traffic capture and session search with both packet-storage and metadata-only modes. Plan for the required OpenSearch or Elasticsearch database and secure deployment configuration.
Who it suits
Arkime suits network operators who need searchable session records and packet inspection in a self-hosted environment. It may also suit teams seeking indicator enrichment and cluster visibility.
Plans and prices
Arkime
Open source · No paid-only features · No license fees
Read 3 Oct 2026 · arkime.com
On the record
- API
- Documented common, viewer, WISE and Cont3xt APIs are available, but the project warns that they can change.arkime.com · read 14 Oct 2026
- API authentication
- Viewer API calls use HTTP digest authentication and many endpoints require database field names.arkime.com · read 14 Oct 2026
- API learning method
- The documentation recommends inspecting browser JavaScript calls because the UI uses the same APIs.arkime.com · read 14 Oct 2026
- Authentication
- Arkime documents authentication modes including basic, form, digest, header, and OIDC, and warns that anonymous authentication is not recommended.arkime.com · read 3 Oct 2026
- Capture modes
- Deployments can keep only enriched session metadata, save selected packets or retain full PCAP.arkime.com · read 14 Oct 2026
- Connections graph
- The Connections page visualizes relationships between selected source and destination fields.arkime.com · read 14 Oct 2026
- Cont3xt
- Cont3xt enriches indicators through integrations such as VirusTotal, Censys and Shodan and can produce reports.arkime.com · read 14 Oct 2026
- Database dependency
- A working OpenSearch or Elasticsearch cluster is required before installing Arkime sensors.arkime.com · read 14 Oct 2026
- Database requirement
- Arkime requires OpenSearch or Elasticsearch to store network-session metadata.arkime.com · read 3 Oct 2026
- Deployment
- The installation guide covers Linux, recommends Debian or Ubuntu LTS, and also links to a container installation guide.arkime.com · read 3 Oct 2026
- Docker
- Official Docker images have been provided since version 5.5.0 and contain all Arkime applications.arkime.com · read 14 Oct 2026
- Documentation depth
- Documentation covers installation, FAQ troubleshooting, architecture, settings, supported protocols, plugins, APIs and contribution workflows.arkime.com · read 14 Oct 2026
- Extensibility
- The project documents capture rules, tagger plugins, command sockets, Python support, WISE sources and S3 storage.arkime.com · read 14 Oct 2026
- Hardware guidance
- The installation guide recommends at least 4 GB OpenSearch JVM heap and no more than half of system memory for that heap.arkime.com · read 14 Oct 2026
- Independent security practice
- OpenSSF records Arkime as having achieved its Best Practices badge in October 2023.bestpractices.dev · read 14 Oct 2026
- Integrations
- Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration.github.com · read 14 Oct 2026
- Investigation
- Users can search sessions, inspect packet data, and export search results as PCAP or CSV.arkime.com · read 3 Oct 2026
- Licence
- Arkime is distributed under the permissive Apache License 2.0.github.com · read 14 Oct 2026
