Arkime vs Zui
Arkime
arkime.com
Zui
zui.brimdata.ioSide by side
| Figure | Arkime | Zui |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | — |
| Web | Yes | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Network Packet Analyzer Software | 9.0 (#3) | 7.3 (#29) |
| Spec score · Network Protocol Analyzers | 9.0 (#3) | 7.3 (#27) |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | Zui is a desktop application for querying and debugging Zed lakes. |
| Security | The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy. | The maker says Zui releases are signed with a code signing certificate to indicate the installer came from Brim Data and has not been tampered with since it was built. |
| Support | The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests. | The installation guide directs users who need help to troubleshooting documentation and the public Slack community. |
Plans
In their own words
Arkime
Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.
Zui
Zui is a free desktop application for exploring, querying, and debugging data in Zed lakes. It runs on Linux, macOS, and Windows, with drag-and-drop ingest, schema inference, named queries, filters, and pivots. Users can preview and shape data while loading it; imported data is stored locally under the Zui data directory, and the application can also connect to a remote Zed lake.
For packet capture analysis, bundled Brimcap creates Zeek and Suricata summary logs, and Zui can extract packet flows. Packet views can correlate Zeek events with Suricata alerts and offer right-click queries to VirusTotal or whois. Bundled Suricata uses Emerging Threats Open rules by default and updates them when Zui launches while connected to the internet. The maker says releases are signed with a code signing certificate to indicate the installer came from Brim Data and has not been changed since it was built. Brim Data continues to publish legacy Zed and Zui releases and documentation while developing SuperDB. Linux updates require manually uninstalling and reinstalling; the installation guide points users to troubleshooting documentation and a public Slack community.