Arkime

7.0easy start · #7 of 33
in Network Packet Analyzer Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you worknot on record

Runs on api, Linux, self-hosted, Web.

Arkime is ranked #7 of 33 in network packet analyzer software on The Geeks Club. It runs on API, Linux, Self-hosted, Web. There is a free plan.

Arkime plans and pricing

All plans

Arkime Free Open source · No paid-only features · No license fees arkime.com · 3 Oct 2026

Compared on network packet analyzer software

Free plan: Yes

Best Arkime alternatives

See all 12

NETCAP 0 of 4 in the starter kit Lesson 17.8 NetworkMiner 0 of 4 in the starter kit Lesson 27.2 PacketSafari 0 of 4 in the starter kit Lesson 37.1 Scapy 0 of 4 in the starter kit Lesson 47.1 Xplico 0 of 4 in the starter kit Lesson 57.1 Zui 0 of 4 in the starter kit Lesson 67.1

The record

Purpose: Arkime is an open-source network analysis and session search tool that passively watches network traffic and creates searchable session records.
Session data: It parses layers 3–7 and indexes session fields such as protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch.
Packet capture: Arkime can store full packets in standard PCAP format or run as a metadata-only engine, with rules to select which traffic is saved.
Investigation: Users can search sessions, inspect packet data, and export search results as PCAP or CSV.
Cont3xt: Cont3xt enriches indicators from commercial and OSINT sources, including VirusTotal, Censys, and Shodan, and supports custom links and downloadable reports.
Supported indicators: Cont3xt auto-enriches supported IP, domain or hostname, URL, email, hash, and phone indicators, with phone enrichment limited to the U.S.
Parliament: Parliament groups Arkime clusters and displays cluster issues and Elasticsearch health.
Database requirement: Arkime requires OpenSearch or Elasticsearch to store network-session metadata.
Deployment: The installation guide covers Linux, recommends Debian or Ubuntu LTS, and also links to a container installation guide.
Scale: Arkime can scale capture horizontally by adding capture machines or vertically with more CPUs and disk.
Security: The architecture guide recommends restricting database and viewer ports with firewall rules and routing operator access through a central viewer, potentially behind a reverse proxy.
Authentication: Arkime documents authentication modes including basic, form, digest, header, and OIDC, and warns that anonymous authentication is not recommended.
Security reporting: The project directs users to report security issues to Intigriti or [email protected].
Support: The project offers a Slack workspace and office hours for questions, and GitHub Issues for bugs and feature requests.
Price from: Free

Where it ranks on The Geeks Club

Best Network Packet Analyzer Software in 2026#7 of 33
Best Network Protocol Analyzers in 2026#5 of 30
Best Digital Forensics Software in 2026#5 of 29
Best Network Packet Capture Software in 2026#4 of 20

Is Arkime yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Arkime

Sources

arkime.com· checked 3 Oct 2026
arkime.com/cont3xt· checked 3 Oct 2026
arkime.com/install· checked 3 Oct 2026
arkime.com/architecture· checked 3 Oct 2026
arkime.com/settings· checked 3 Oct 2026
arkime.com/questions· checked 3 Oct 2026
arkime.com/sponsor· checked 3 Oct 2026