Arkime vs Tsurugi Linux

Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.

Tsurugi Linux is a free Linux distribution for digital forensics, incident response, malware analysis, and OSINT. Its 64-bit [LAB] edition is based on Ubuntu 24.04.3 LTS with a custom kernel based on version 6.19.10, including kernel-level device write blocking. It also provides a Computer Vision analysis section and an OSINT profile switcher. The system can run live, although the project’s primary aim is an installed forensics lab. Tsurugi Acquire is a separate lightweight 32-bit live edition for booting a computer and acquiring mass-storage devices. The related Bento toolkit contains over 300 applications for live forensics and incident response on Windows, Linux, and macOS. The project recommends checking image hashes and verifying signatures with its PGP public key. [LAB] updates come from official Ubuntu repositories, but the FAQ warns that dist-upgrade can break the operating system. Tsurugi Linux [LAB] and Tsurugi Acquire are free under the GNU General Public License and supplied without warranty; some included tools are not open source. Evidence work can cover disks, volatile memory, mobile devices, file systems, OS artifacts, and cloud sources.