Arkime vs PCAPdroid

Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.

PCAPdroid is an open-source Android network capture and monitoring tool that works without root privileges. It uses Android VpnService to receive app traffic, then processes it locally without creating an external VPN. Its connection view shows protocol, ports, addresses, status and traffic volume. Captures can be saved as PCAP files or sent remotely for analysis, and the app supports offline trace analysis, display filters and command-line capture. It can decrypt HTTPS/TLS traffic for a specific app, subject to Android certificate trust limitations. The free plan covers core monitoring and capture; paid features add a firewall for blocking apps, domains and IP addresses with configurable rules and allowlists, as well as malware detection using third-party blacklists and PCAPng format. PCAPdroid supports real-time PCAP-over-IP analysis with tools such as Wireshark, ntopng and tcpdump. In non-root mode it captures only outgoing connections started by the device running it, not traffic from other devices on the network. The project says it collects no information and processes traffic locally.