Arkime vs NETCAP
Arkime
arkime.com
NETCAP
netcap.ioSide by side
| Figure | Arkime | NETCAP |
|---|---|---|
| Price from | Free | €49/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | Yes | Yes |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 3 |
| Spec score · Network Packet Analyzer Software | 9.0 (#3) | 9.2 (#2) |
| Spec score · Network Protocol Analyzers | 9.0 (#3) | 9.1 (#2) |
| API | Documented common, viewer, WISE and Cont3xt APIs are available, but the project warns that they can change. | The project exposes a Go Writer API for writing Protocol Buffer and CSV audit records, including headers and buffered channels. |
| Documentation depth | Documentation covers installation, FAQ troubleshooting, architecture, settings, supported protocols, plugins, APIs and contribution workflows. | Documentation includes overview, quickstart, installation, configuration, packet collection, specification, rules, tests, FAQ and API-oriented examples. |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | Pro lists handoffs or integrations with Wireshark, Metasploit, hashcat, John, and BetterCrack; Core includes a Maltego transformation plugin. |
| Limit: deployment complexity | The installation guide requires separate sensor and search-database components, credentials, initialization and service configuration. | Independent technical notes say Hyperscan acceleration requires libhs through pkg-config, which complicates cross-platform CI/CD. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | NETCAP converts network packet streams into structured audit records for network analysis, security research, machine learning, and forensics. |
| Security | The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy. | The download page says Pro analyzes captures locally on the user's machine and has no upload step. |
| Self-hosting | Arkime is installed as Linux packages or official containers and runs its capture and viewer services on infrastructure you operate. | Core can be built from source, installed as precompiled binaries, or run from Alpine and Ubuntu Docker images. |
| Support | The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests. | Pro includes email support, Enterprise offers priority support with an SLA, and Core lists community support. |
| What it does | Arkime passively captures network traffic, indexes session metadata and can retain packets as standard PCAP for investigation. | NETCAP converts live network traffic or PCAP files into structured, type-safe audit records for security research, forensics, monitoring and machine-learning workflows. |
Plans
In their own words
Arkime
Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.
NETCAP
NETCAP converts network packet streams into structured audit records for network analysis, security research, machine learning and forensics. Its free Core edition covers 66+ record types for protocols including TCP, UDP, HTTP, TLS, DNS and DHCP. Core captures live traffic, processes PCAP files, supports distributed collection and HTTP proxy capture, and outputs Protocol Buffers, CSV, JSON streams and Prometheus metrics. It is an open-source CLI under GPL-3.0, with platform binaries and Docker images.
Pro adds interactive graph analysis, a network activity timeline, investigation notes and more than 35 analysis modules. It can flag anomalies in decoded traffic and draft incident reports for editing; the maker says Pro analyzes captures locally without an upload step. Pro is available for macOS, Windows and Linux and includes email support. The plan is listed at $548 a month, with a €48/year option also shown, and a 14-day trial without a credit card. Enterprise has custom pricing and includes unlimited team seats, priority support with an SLA, custom integrations and volume licensing.