Arkime vs EndaceVision
Arkime
arkime.comEndaceVision
endace.comSide by side
| Figure | Arkime | EndaceVision |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | Yes | — |
| Web | Yes | Yes |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Network Packet Capture Software | 8.9 (#1) | 7.3 (#15) |
| Founded | 2012 | 2001 |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | Endace says Cisco Secure Network Analytics can link alerts to related packet-level Network History in EndaceVision. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | EndaceVision is a browser-based application for investigating security threats and network or application performance issues using historical packet data. |
| Security controls | Arkime supports TLS for the viewer, digest authentication, reverse-proxy authentication, OpenSearch credentials and API keys. | The EndaceVision datasheet lists support for role-based access control and TACACS security. |
| Support | The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests. | Endace says its worldwide support call center is available 24×7 and premium support includes 24×7×365 phone, email, and portal support. |
Plans
In their own words
Arkime
Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.
EndaceVision
EndaceVision is a browser-based application for investigating security threats and network or application performance issues from historical packet data. Analysts can search and filter recorded traffic by link name, application classification, IP or MAC address, port, timestamp, and other parameters. EndaceProbes use built-in deep packet inspection to classify captured traffic by application. Visualizations cover bandwidth over time, conversations, traffic over time, and top talkers. MicroVision uses packet timestamps to show short events at microsecond detail, including average and maximum values for each sample point. A hosted Wireshark instance lets analysts decode packets on EndaceProbes or InvestigationManager without downloading large captures. The datasheet lists role-based access control and TACACS security. Access runs in modern desktop or tablet browsers with appropriate credentials. EndaceVision is included on EndaceProbe Analytics Platforms and InvestigationManager, with pcap and ERF capture formats listed. It is aimed at security, network, and IT teams. Endace was founded in 2001 and is headquartered in Auckland, New Zealand. Pricing is available on request.