Arkime vs nChronos
Arkime
arkime.comnChronos
colasoft.comSide by side
| Figure | Arkime | nChronos |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | Yes | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Network Packet Capture Software | 8.9 (#1) | 7.4 (#12) |
| Deployment | The installation guide covers Linux, recommends Debian or Ubuntu LTS, and also links to a container installation guide. | The product uses a client/server architecture, with server-side capture, analysis and storage and a console for viewing and analyzing server data. |
| Founded | 2012 | 2001 |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | nChronos can replay packet files in formats including libpcap used by Wireshark, Ethereal and Tcpdump, plus several vendor packet formats. |
| Packet capture | Arkime can store full packets in standard PCAP format or run as a metadata-only engine, with rules to select which traffic is saved. | The server captures and stores network packets continuously and supports deployment through a network mirror port or link tap. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | nChronos is an application-centric network performance analysis system combining a server and console for continuous packet capture, storage, data mining and traffic analysis. |
| Security | The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy. | The maker says connections between nChronos Server and Console are encrypted using a private encryption algorithm. |
| Support | The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests. | The maker provides an online support form and says a Colasoft representative responds to quote requests within one business day. |
Plans
In their own words
Arkime
Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.
nChronos
nChronos is Colasoft’s application-focused network performance analysis system for medium and large corporate networks. Its client/server design places continuous packet capture, analysis, storage and data mining on a server, while a console displays and analyzes the collected data. The server can receive traffic through a network mirror port or link tap and retain packets for later investigation of network or application problems. Real-time statistics and user-defined alerts show network events as they occur. System or custom reports can be scheduled for hourly, daily, weekly or monthly email delivery. Users can define application and transaction monitoring, with profiles for HTTP, FTP, email and DNS. Packet files can be replayed from Colasoft, libpcap and several vendor formats, including files associated with Wireshark, Ethereal and Tcpdump. Linux server systems and Windows consoles are listed, with browser-based server configuration. Standard specifications allow four logical links, eight capture interfaces and two concurrent server connections.