Arkime vs EndaceProbe
Arkime
arkime.com
EndaceProbe
endace.comSide by side
| Figure | Arkime | EndaceProbe |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | Yes | — |
| Web | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Network Packet Capture Software | 8.9 (#1) | 7.8 (#10) |
| Deployment | The installation guide covers Linux, recommends Debian or Ubuntu LTS, and also links to a container installation guide. | The product is available as physical appliances and as cloud or virtual deployments, including AWS, Microsoft Azure, VMware, KVM, and Nutanix options. |
| Founded | 2012 | 2001 |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | Its APIs and Fusion Partner integrations connect packet history to security and performance monitoring tools, including commercial, open-source, and custom applications. |
| Investigation | Users can search sessions, inspect packet data, and export search results as PCAP or CSV. | The browser-based EndaceVision application searches and examines historical packet data and includes Wireshark for packet decoding without downloading large pcaps. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | EndaceProbe provides continuous full packet capture and recorded network history for investigating security threats, performance issues, and outages. |
| Security | The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy. | Endace states that its probes use a cryptographic module for encrypted communications and have FIPS 140-3 validation, Common Criteria NDcPP v2.2e certification, and DoDIN APL listing. |
| Support | The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests. | The Americas support terms list 24×7×365 availability, phone and email support, remote diagnostics, software updates, and a five-minute initial phone response time. |
Plans
In their own words
Arkime
Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.
EndaceProbe
EndaceProbe continuously records complete network packets, preserving network history for investigations into security threats, performance issues, and outages. It is offered as physical appliances and cloud or virtual deployments on AWS, Microsoft Azure, VMware, KVM, and Nutanix. Listed models sustain recording from 500 Mbps to 100 Gbps, with packet storage ranging from 1 TB to more than 3 PB. InvestigationManager provides centralized search and data mining, while EndaceCMS manages physical and cloud probes. Browser-based EndaceVision searches historical packets and includes hosted Wireshark decoding without downloading large PCAP files. The platform supports live capture, offline trace analysis, display filters, protocol decryption, and pcap, pcapng, and ERF formats. Endace lists Elastic integrations and an API for open-source, custom, and Fusion Partner tools. Appliances can host applications such as EndaceFlow. Security controls include hardened Linux, disabled shell access, authentication options, role-based access, and stated certifications. Pricing is available on request.