Arkime
7.3#1 in digital forensics softwareFree planFree planWebAPILinuxSelf-hosted
VisitArkime vs CAINE
What both publish
| Fact | Arkime | CAINE |
|---|---|---|
| Extensibility | The project documents capture rules, tagger plugins, command sockets, Python support, WISE sources and S3 storage. | The project says its open distribution can be rebuilt into a differently branded version. |
| Licence | Arkime is distributed under the permissive Apache License 2.0. | CAINE and its Windows-side tools are offered under the GNU Lesser General Public License version 2.1 or later, while bundled components retain their own licences. |
| Project origin | The project README says Arkime was created at AOL in 2012 to replace commercial full-packet systems. | CAINE began in 2008 as a graduation thesis at the University of Modena and Reggio Emilia. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | CAINE is an Italian GNU/Linux live distribution created as a digital forensics project. |
Arkime plans
- ArkimeFree
CAINE plans
- CAINEFree
- Free CAINE ISOFree
Pick Arkime if…
Arkime suits teams that need to search and inspect network sessions and can provide OpenSearch or Elasticsearch for metadata storage. It is designed for self-hosted use, with Linux installation guidance and a container guide.
Pick CAINE if…
CAINE suits digital investigators who need a Linux forensic environment with a graphical interface and bundled analysis utilities. Its Windows forensic side tools may also suit users handling Windows incident response.