Arkime vs Wireshark
Arkime
arkime.comWireshark
wireshark.orgSide by side
| Figure | Arkime | Wireshark |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | Yes |
| Web | Yes | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Network Packet Capture Software | 8.9 (#1) | 8.2 (#6) |
| Spec score · Network Packet Analyzer Software | 9.0 (#3) | 8.3 (#10) |
| Spec score · Network Protocol Analyzers | 9.0 (#3) | 8.2 (#10) |
| API | Documented common, viewer, WISE and Cont3xt APIs are available, but the project warns that they can change. | The sharkd daemon exposes JSON-RPC over standard input or Unix/TCP sockets for programmatic packet dissection, filtering and analysis. |
| Extensibility | The project documents capture rules, tagger plugins, command sockets, Python support, WISE sources and S3 storage. | The extcap interface lets external binaries or scripts appear as capture interfaces and be configured through the GUI. |
| Founded | 2012 | 1998 |
| Licence | Arkime is distributed under the permissive Apache License 2.0. | Wireshark is open source under GNU GPL version 2 or later, with source code available for modification and redistribution under the licence. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | Wireshark captures and interactively browses network traffic as a network protocol analyzer. |
| Self-hosting | Arkime is installed as Linux packages or official containers and runs its capture and viewer services on infrastructure you operate. | The software is distributed as source and native packages, so organizations can build and operate it locally without a hosted service. |
| Support | The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests. | Community support is available through the Q&A site and Wireshark users mailing list. |
| Supported operating systems | Arkime 6 documentation lists Debian 12/13, Ubuntu 22.04/24.04, EL 9/10, Amazon Linux 2023, Arch and FreeBSD 14/15, with older releases dropped. | Official learning material lists Windows, macOS, Linux and UNIX support, with source builds possible on other platforms. |
| What it does | Arkime passively captures network traffic, indexes session metadata and can retain packets as standard PCAP for investigation. | Wireshark captures and interactively examines traffic moving across computer networks for troubleshooting, analysis, development and education. |
Plans
In their own words
Arkime
Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.
Wireshark
Wireshark is a free network protocol analyzer for capturing and examining network traffic. It supports live capture and offline analysis through a graphical interface or the TShark terminal utility, and can inspect hundreds of protocols. Display filters narrow what appears during analysis, though their syntax differs from capture filters. Wireshark reads and writes capture formats including pcap and pcapng, and can decompress gzip-compressed files. Analysis features include VoIP tools, packet coloring rules, and exports to XML, PostScript, CSV, or plain text. It can decrypt traffic for protocols including IPsec, Kerberos, SSL/TLS, WEP, and WPA/WPA2. The software is available for Linux, macOS, and Windows under GNU General Public License version 2, with no license fee for the full version. Windows packages include Npcap, which is needed for live packet capture. What a capture can show depends on the operating system, capture library, network interface, and network configuration; switched networks may not expose unicast traffic between other ports. Community help is available through a Q&A site and users mailing list.