Arkime

What Arkime is

Arkime is an open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses network layers 3–7 and indexes fields such as protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select saved traffic. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators from commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups Arkime clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime is free, with no license fees or paid-only features. Its installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required to store session metadata. Authentication options include basic, form, digest, header, and OIDC; the project advises against anonymous authentication.