Arkime
7.3#1 in digital forensics softwareFree planFree planWebAPILinuxSelf-hosted
VisitArkime vs Wireshark
What both publish
| Fact | Arkime | Wireshark |
|---|---|---|
| API | Documented common, viewer, WISE and Cont3xt APIs are available, but the project warns that they can change. | The sharkd daemon exposes JSON-RPC over standard input or Unix/TCP sockets for programmatic packet dissection, filtering and analysis. |
| Extensibility | The project documents capture rules, tagger plugins, command sockets, Python support, WISE sources and S3 storage. | The extcap interface lets external binaries or scripts appear as capture interfaces and be configured through the GUI. |
| Founded | 2012 | 1998 |
| Licence | Arkime is distributed under the permissive Apache License 2.0. | Wireshark is open source under GNU GPL version 2 or later, with source code available for modification and redistribution under the licence. |
| Purpose | Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records. | Wireshark captures and interactively browses network traffic as a network protocol analyzer. |
Arkime plans
- ArkimeFree
Wireshark plans
- WiresharkFree
Pick Arkime if…
Arkime suits teams that need to search and inspect network sessions and can provide OpenSearch or Elasticsearch for metadata storage. It is designed for self-hosted use, with Linux installation guidance and a container guide.
Pick Wireshark if…
Wireshark is suited to network professionals, security experts, developers, and educators who need to inspect captured traffic. It supports both graphical and terminal-based analysis.