Arkime
7.3#1 in digital forensics softwareFree planFree planWebAPILinuxSelf-hosted
VisitArkime vs EndaceProbe
EndaceProbe
5.6#16 in network packet capture softwareWebAPILinuxSelf-hosted
VisitWhat both publish
| Fact | Arkime | EndaceProbe |
|---|---|---|
| Deployment | The installation guide covers Linux, recommends Debian or Ubuntu LTS, and also links to a container installation guide. | The product is available as physical appliances and as cloud or virtual deployments, including AWS, Microsoft Azure, VMware, KVM, and Nutanix options. |
| Founded | 2012 | 2001 |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | Its APIs and Fusion Partner integrations connect packet history to security and performance monitoring tools, including commercial, open-source, and custom applications. |
| Investigation | Users can search sessions, inspect packet data, and export search results as PCAP or CSV. | The browser-based EndaceVision application searches and examines historical packet data and includes Wireshark for packet decoding without downloading large pcaps. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | EndaceProbe provides continuous full packet capture and recorded network history for investigating security threats, performance issues, and outages. |
| Security | The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy. | Endace states that its probes use a cryptographic module for encrypted communications and have FIPS 140-3 validation, Common Criteria NDcPP v2.2e certification, and DoDIN APL listing. |
Arkime plans
- ArkimeFree
EndaceProbe plans
- EndaceProbePriced on request
Pick Arkime if…
Arkime suits teams that need to search and inspect network sessions and can provide OpenSearch or Elasticsearch for metadata storage. It is designed for self-hosted use, with Linux installation guidance and a container guide.
Pick EndaceProbe if…
EndaceProbe is for organizations investigating network security, performance, and outage issues that need recorded packet history. Endace lists sectors including healthcare, finance, government, telecom, and broadcast.