Arkime vs PcapAI
Arkime
arkime.comPcapAI
pcapai.comSide by side
| Figure | Arkime | PcapAI |
|---|---|---|
| Price from | Free | $9.50/mo |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | Yes | Yes |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 13 |
| Spec score · Network Packet Analyzer Software | 9.0 (#3) | 8.4 (#6) |
| API authentication | Viewer API calls use HTTP digest authentication and many endpoints require database field names. | API requests require a Bearer token and API access is restricted to Advanced subscribers. |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | The maker describes use with SIEM systems, CI/CD pipelines, ticketing workflows and custom backend scripts. |
| Security | The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy. | The maker says transfers use TLS 1.3, files are encrypted at rest during processing, and each analysis runs in an isolated container. |
| Security controls | Arkime supports TLS for the viewer, digest authentication, reverse-proxy authentication, OpenSearch credentials and API keys. | The maker states that transfers use TLS 1.3, files are encrypted in Amazon S3 and analyses run in isolated containers. |
| Support | The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests. | The FAQ says most standard captures process in under one to two minutes and high-volume files often complete in under five minutes on dedicated infrastructure. |
| What it does | Arkime passively captures network traffic, indexes session metadata and can retain packets as standard PCAP for investigation. | PcapAI is a web platform that automatically analyzes PCAP and PCAPNG captures with AI and deep packet inspection. |
Plans
PcapAI
- Single Report$9, paid once
- Starter$19 a month
- Starter pack$35, paid once
- Pro$49 a month
- Standard pack$83, paid once
- Advanced$99 a month
- Starter (yearly)$114 a year
- Starter yearly$114 a year
- Pro pack$135, paid once
- Pro (yearly)$294 a year
In their own words
Arkime
Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.
PcapAI
PcapAI analyzes PCAP and PCAPNG network captures and creates security reports. Its machine-learning models evaluate packet context and relate findings to MITRE ATT&CK techniques. Reports are downloadable PDFs with risk scores, packet evidence, findings, and remediation steps. The service detects plaintext credentials, NTLM hashes, Kerberos tickets, and session tokens, then masks discovered credentials in reports. It also surfaces retransmissions, per-flow latency, TCP Zero Window events, and ARP conflicts. The homepage offers free uploads without an account; compressed archives are not accepted, and file-size limits vary by plan. Options include web, API, Windows, macOS, Linux, and self-hosted use. An open-source MCP Server supports local analysis with AI assistants such as Claude Desktop; the maker says packet data stays on the device. The Advanced plan includes API access, and the maker describes sending findings to Splunk, Elastic SIEM, or Microsoft Sentinel. Pricing includes a $9.00 USD one-time Single Report, monthly and annual plans, and one-time packs.