Arkime vs Sniffnet
Arkime
arkime.comSniffnet
sniffnet.appSide by side
| Figure | Arkime | Sniffnet |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | Yes |
| Web | Yes | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 1 | 2 |
| Spec score · Network Packet Capture Software | 8.9 (#1) | 8.2 (#5) |
| Spec score · Network Packet Analyzer Software | 9.0 (#3) | 8.2 (#11) |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | The webhook documentation gives SIGNL4, IFTTT, Svix and Webhook.site as compatible notification receivers. |
| Licence | Arkime is distributed under the permissive Apache License 2.0. | Sniffnet is dual-licensed under MIT or Apache-2.0. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | Sniffnet is a network monitoring app for keeping track of Internet traffic, checking bandwidth usage, and inspecting network activity. |
| Security | The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy. | A 2025 security audit covered static analysis, dependency checking, code analysis and fuzzing, dynamic analysis on most supported platforms, and interactive testing; its only relevant finding was low severity and had been fixed. |
| Support | The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests. | The download page directs users with persistent installation problems or doubts to open an issue. |
| What it does | Arkime passively captures network traffic, indexes session metadata and can retain packets as standard PCAP for investigation. | Sniffnet is a desktop application for monitoring Internet traffic, bandwidth use and network connections. |
Plans
In their own words
Arkime
Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.
Sniffnet
Sniffnet is a free network monitoring app for Linux, macOS, and Windows. It displays overall internet traffic statistics and real-time charts, and can show which programs use bandwidth. Users can choose a network adapter, filter observed traffic, and import or export PCAP capture reports. Sniffnet identifies local network connections, shows remote hosts’ geographical locations, and finds host domain names and ASNs. It recognizes more than 6,000 upper-layer services, protocols, trojans, and worms. Users can configure notifications for network events and import custom IP blacklists to highlight potentially dangerous connections. The app supports live capture, display filters, protocol dissectors, and offline trace analysis; it reads PCAPNG and CAP files as well as PCAP. Custom themes and 26 languages are available. The listed Sniffnet plan is free and the software is open-source under MIT or Apache-2.0. A 2025 security audit reported one low-severity finding, which had been fixed. Most functionality uses offline databases, while reverse DNS lookups provide hostnames for IP addresses.