Arkime vs CloudShark
Arkime
arkime.com
CloudShark
qacafe.comSide by side
| Figure | Arkime | CloudShark |
|---|---|---|
| Price from | Free | $29/mo |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | Yes | — |
| Web | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Network Packet Analyzer Software | 9.0 (#3) | 8.1 (#13) |
| Spec score · Network Protocol Analyzers | 9.0 (#3) | 8.1 (#11) |
| Authentication | Arkime documents authentication modes including basic, form, digest, header, and OIDC, and warns that anonymous authentication is not recommended. | The product page states that CloudShark Enterprise supports permission-based access and SSO. |
| Deployment | The installation guide covers Linux, recommends Debian or Ubuntu LTS, and also links to a container installation guide. | CloudShark Enterprise is available as an OVA and can also be deployed in Docker environments. |
| Founded | 2012 | 2001 |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | The REST API connects CloudShark Enterprise with ticketing systems, SIEM platforms, capture appliances, and other automation tools. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | CloudShark Enterprise is a centrally deployed packet analysis platform for network and security teams. |
| Support | The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests. | QA Cafe provides CloudShark installation, user, administration, and API guides, and directs customers to support by email. |
Plans
CloudShark
- CloudShark Personal$29 a month
- CloudShark EnterprisePriced on request
In their own words
Arkime
Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.