Arkime
7.3#1 in digital forensics softwareFree planFree planWebAPILinuxSelf-hosted
VisitArkime vs nChronos
What both publish
| Fact | Arkime | nChronos |
|---|---|---|
| Deployment | The installation guide covers Linux, recommends Debian or Ubuntu LTS, and also links to a container installation guide. | The product uses a client/server architecture, with server-side capture, analysis and storage and a console for viewing and analyzing server data. |
| Founded | 2012 | 2001 |
| Integrations | Arkime uses OpenSearch or Elasticsearch for indexed metadata and offers WISE threat-intelligence integration. | nChronos can replay packet files in formats including libpcap used by Wireshark, Ethereal and Tcpdump, plus several vendor packet formats. |
| Packet capture | Arkime can store full packets in standard PCAP format or run as a metadata-only engine, with rules to select which traffic is saved. | The server captures and stores network packets continuously and supports deployment through a network mirror port or link tap. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | nChronos is an application-centric network performance analysis system combining a server and console for continuous packet capture, storage, data mining and traffic analysis. |
| Security | The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy. | The maker says connections between nChronos Server and Console are encrypted using a private encryption algorithm. |
Arkime plans
- ArkimeFree
nChronos plans
- nChronos 6.4Priced on request
Pick Arkime if…
Arkime suits teams that need to search and inspect network sessions and can provide OpenSearch or Elasticsearch for metadata storage. It is designed for self-hosted use, with Linux installation guidance and a container guide.
Pick nChronos if…
nChronos is aimed at teams monitoring network traffic in medium and large organizations. It may suit administrators who need continuous packet capture, retrospective analysis, alerts and scheduled reporting in a client/server deployment.