Skip to content
SPECIFICTION
Get listed

Arkime

arkime.com

Free plan Open source WebLinuxAPISelf-hosted
Visit arkime.com
Spec score 9.0 #1 of 30 in Digital Forensics Software

What it is

Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.

Spec sheet

What it does
Arkime passively captures network traffic, indexes session metadata and can retain packets as standard PCAP for investigation.Read 14 Oct 2026 · arkime.com
Purpose
Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records.Read 3 Oct 2026 · arkime.com
Deployment
The installation guide covers Linux, recommends Debian or Ubuntu LTS, and also links to a container installation guide.Read 3 Oct 2026 · arkime.com
API
Documented common, viewer, WISE and Cont3xt APIs are available, but the project warns that they can change.Read 14 Oct 2026 · arkime.com
Integrations
Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration.Read 14 Oct 2026 · github.com
Security
The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy.Read 3 Oct 2026 · arkime.com
Support
The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests.Read 3 Oct 2026 · arkime.com
Founded
2012Read 28 Sep 2026 · arkime.com
API authentication
Viewer API calls use HTTP digest authentication and many endpoints require database field names.Read 14 Oct 2026 · arkime.com
API learning method
The documentation recommends inspecting browser JavaScript calls because the UI uses the same APIs.Read 14 Oct 2026 · arkime.com
Authentication
Arkime documents authentication modes including basic, form, digest, header, and OIDC, and warns that anonymous authentication is not recommended.Read 3 Oct 2026 · arkime.com
Capture modes
Deployments can keep only enriched session metadata, save selected packets or retain full PCAP.Read 14 Oct 2026 · arkime.com
Connections graph
The Connections page visualizes relationships between selected source and destination fields.Read 14 Oct 2026 · arkime.com
Cont3xt
Cont3xt enriches indicators through integrations such as VirusTotal, Censys and Shodan and can produce reports.Read 14 Oct 2026 · arkime.com
Database dependency
A working OpenSearch or Elasticsearch cluster is required before installing Arkime sensors.Read 14 Oct 2026 · arkime.com
Database requirement
Arkime requires OpenSearch or Elasticsearch to store network-session metadata.Read 3 Oct 2026 · arkime.com
Docker
Official Docker images have been provided since version 5.5.0 and contain all Arkime applications.Read 14 Oct 2026 · arkime.com
Documentation depth
Documentation covers installation, FAQ troubleshooting, architecture, settings, supported protocols, plugins, APIs and contribution workflows.Read 14 Oct 2026 · arkime.com
Extensibility
The project documents capture rules, tagger plugins, command sockets, Python support, WISE sources and S3 storage.Read 14 Oct 2026 · arkime.com
Hardware guidance
The installation guide recommends at least 4 GB OpenSearch JVM heap and no more than half of system memory for that heap.Read 14 Oct 2026 · arkime.com
Independent security practice
OpenSSF records Arkime as having achieved its Best Practices badge in October 2023.Read 14 Oct 2026 · bestpractices.dev
Investigation
Users can search sessions, inspect packet data, and export search results as PCAP or CSV.Read 3 Oct 2026 · arkime.com
Licence
Arkime is distributed under the permissive Apache License 2.0.Read 14 Oct 2026 · github.com
Limit: deployment complexity
The installation guide requires separate sensor and search-database components, credentials, initialization and service configuration.Read 14 Oct 2026 · arkime.com
Limit: packet loss troubleshooting
The FAQ has dedicated troubleshooting for dropped packets and disk-queue problems, indicating capture performance can require tuning.Read 14 Oct 2026 · arkime.com
Limit: storage operations
The independent source indicates that retaining complete traffic creates substantial data volumes that must be indexed and stored.Read 14 Oct 2026 · securityscientist.net
Packet capture
Arkime can store full packets in standard PCAP format or run as a metadata-only engine, with rules to select which traffic is saved.Read 3 Oct 2026 · arkime.com
Packet export
Search results can be exported as PCAP or CSV for use in other tools.Read 14 Oct 2026 · arkime.com
Parliament
Parliament provides a landing page and health monitoring for multiple Arkime clusters.Read 14 Oct 2026 · arkime.com
Praise: forensic visibility
An independent security explainer praises Arkime for exposing packet payloads and reconstructing sessions instead of showing metadata alone.Read 14 Oct 2026 · securityscientist.net
Praise: indexed scale
The independent source describes Elasticsearch-backed indexing as enabling fast searches across very large traffic datasets.Read 14 Oct 2026 · securityscientist.net
Praise: interoperability
The independent source says standard PCAP export lets investigators move captures into Wireshark and other forensic tools.Read 14 Oct 2026 · securityscientist.net
Praise: retrospective hunting
The same independent source highlights searching historical captures for newly identified indicators of compromise.Read 14 Oct 2026 · securityscientist.net
Project origin
The project README says Arkime was created at AOL in 2012 to replace commercial full-packet systems.Read 14 Oct 2026 · github.com
Protocol parsing
Arkime extracts hundreds of fields from layers 3 through 7, including DNS, HTTP, TLS/JA4, hashes and GeoIP.Read 14 Oct 2026 · arkime.com
Release change
Arkime 5 removed old v1 APIs and changed the default authentication mode from anonymous to digest.Read 14 Oct 2026 · arkime.com
Release feature
Arkime 5 added Cont3xt bulk search, JA4 fields, unified configuration and direct offline PCAP retrieval from S3 or HTTP(S).Read 14 Oct 2026 · arkime.com
Retention operations
Retention can be managed with Elasticsearch ILM, OpenSearch ISM or a daily expiration cron job.Read 14 Oct 2026 · arkime.com
Scale
Arkime can scale capture horizontally by adding capture machines or vertically with more CPUs and disk.Read 3 Oct 2026 · arkime.com
Security controls
Arkime supports TLS for the viewer, digest authentication, reverse-proxy authentication, OpenSearch credentials and API keys.Read 14 Oct 2026 · github.com
Security reporting
The project directs users to report security issues to Intigriti or [email protected].Read 3 Oct 2026 · arkime.com
Self-hosting
Arkime is installed as Linux packages or official containers and runs its capture and viewer services on infrastructure you operate.Read 14 Oct 2026 · arkime.com
Session data
It parses layers 3–7 and indexes session fields such as protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch.Read 3 Oct 2026 · arkime.com
Session search
The web interface searches indexed sessions and supports timeline and country filtering.Read 14 Oct 2026 · arkime.com
SPI views
SPI pages show unique field values, counts, graphs and temporal distributions.Read 14 Oct 2026 · arkime.com
Supported indicators
Cont3xt auto-enriches supported IP, domain or hostname, URL, email, hash, and phone indicators, with phone enrichment limited to the U.S.Read 3 Oct 2026 · arkime.com
Supported operating systems
Arkime 6 documentation lists Debian 12/13, Ubuntu 22.04/24.04, EL 9/10, Amazon Linux 2023, Arch and FreeBSD 14/15, with older releases dropped.Read 14 Oct 2026 · arkime.com
Upgrade burden
Major upgrades are sequential and generally require running the db.pl schema upgrade process.Read 14 Oct 2026 · arkime.com

Plans and prices

Arkime Free Open source · No paid-only features · No license fees Read 3 Oct 2026 · arkime.com

Every Arkime plan and price →

Strong points and limits

Strong points

  • Searches sessions and exports results as PCAP or CSV.
  • Supports full-packet or metadata-only capture.
  • Cont3xt enriches supported indicators from commercial and OSINT sources.
  • Free, with no license fees or paid-only features.

Limits

  • Requires OpenSearch or Elasticsearch for session metadata.
  • Installation guidance is for Linux.
  • Phone enrichment is limited to the U.S.

Who it suits

Arkime suits teams that need searchable network-session records and packet inspection, with the option to retain full packets or capture metadata only. Its documented scaling and authentication options may suit operators managing deployments across capture machines.

Verdict

Arkime offers network-session search, packet inspection, and export alongside indicator enrichment and cluster monitoring. A deployment needs OpenSearch or Elasticsearch, and the project recommends restricting access and avoiding anonymous authentication.

Where Specifiction places it

Alternatives to ArkimeAll alternatives →