Overview

Arkime is an open-source network analysis and session-search platform that passively turns traffic into searchable session records. It is best suited to security and network teams able to operate Linux capture systems and an OpenSearch or Elasticsearch backend. Its case is flexible packet capture and investigation without license fees; the cost is running and securing the supporting infrastructure.

Key features

Arkime parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP. Investigators can search those records, inspect packet data, and export results as PCAP or CSV. That combination supports a workflow from broad session search to packet-level review, but the metadata store is a required dependency: Arkime needs OpenSearch or Elasticsearch and is not a self-contained viewer.

Capture can retain full packets in standard PCAP format or operate as a metadata-only engine, with rules to select which traffic is saved. This gives teams control over the balance between investigative detail and storage, while making retention choices an operational responsibility. Arkime supports remote capture, flow analysis, CLI tools, and both capture sources. It does not provide traffic decryption, so teams needing decrypted payload analysis should look elsewhere.

Cont3xt enriches supported IP, domain or hostname, URL, email, hash, and phone indicators through commercial and OSINT sources including VirusTotal, Censys, and Shodan. Custom links and downloadable reports extend that workflow; phone enrichment is limited to U.S. numbers. Parliament groups Arkime clusters and surfaces cluster issues and Elasticsearch health, which is useful for operators managing more than one cluster.

Pricing

Arkime costs 0.00 USD per free. The Arkime plan is open source, has no paid-only features, and carries no license fees. That makes it accessible for teams prepared to supply and operate the infrastructure, but free software does not remove the need for an OpenSearch or Elasticsearch deployment or the work of managing capture systems and retained traffic.

Platforms

Arkime supports API, Linux, self-hosted, and web use. Its installation guide recommends Debian or Ubuntu LTS and also links to a container installation guide. Capture can scale horizontally by adding capture machines or vertically with more CPUs and disk, giving operators two ways to respond as traffic volume grows.

Security needs deliberate setup. Arkime recommends firewall restrictions on database and viewer ports and routing operator access through a central viewer, potentially behind a reverse proxy. It documents basic, form, digest, header, and OIDC authentication, and explicitly discourages anonymous authentication. The project accepts security reports through Intigriti or security@arkime.com.

For operational questions, users can turn to the project Slack workspace and office hours; GitHub Issues are the channel for bugs and feature requests.

Who it's for

Arkime fits teams that need searchable network-session history, packet retention options, and enrichment in a self-managed environment. It is particularly compelling where the team can operate Linux capture hosts and the required search database, and where controlling what traffic is retained matters. It is a weaker fit for organizations seeking a managed service, a turnkey standalone viewer, or traffic decryption.

Pros and cons

Pros: No license fees and no paid-only features make the full open-source product available without a paid tier.
Pros: Full-PCAP or metadata-only capture, plus configurable traffic-selection rules, lets operators choose their retention depth.
Pros: Search, packet inspection, PCAP/CSV export, and indicator enrichment connect investigation steps in one platform.
Cons: OpenSearch or Elasticsearch is mandatory, adding a database service that teams must deploy and maintain.
Cons: Security depends on disciplined network access controls; the project advises restricting database and viewer ports and avoiding anonymous authentication.
Cons: Traffic decryption is not supported, and phone indicator enrichment is restricted to the U.S.

Alternatives

For a broader set of investigation workflows, compare options in Digital Forensics Software. For capture-focused choices, see Network Packet Capture Software, Network Protocol Analyzers, and Network Packet Analyzer Software.

X-Ways Forensics is a paid, self-hosted Windows option at 1550.00 USD per once for its non-perpetual license; consider it when that licensing model and platform fit better than Arkime's free network-session approach.
Exterro FTK Imager offers a free Windows forensic imaging and preview tool, with FTK Imager Pro at 499.00 USD per year; choose it when imaging and preview are the priority rather than network-session capture.
SUMURI PALADIN is a Linux freemium option: PALADIN LTS is name-your-price, with corporate users required to donate at least $25, and PALADIN PRO is 99.00 USD per once. Consider it for a Linux forensic toolkit instead of Arkime's searchable traffic workflow.
CAINE is a free Linux and Windows ISO image of approximately 4000 MB, with separate licenses for third-party software; consider it when a forensic distribution is a better fit.
NetworkMiner is a freemium option for Linux, macOS, and Windows, with a GPLv2 free and open-source edition written in managed C# on .NET Framework; consider it when those platform and licensing characteristics suit your stack.
Plaso is a free option for Linux, macOS, self-hosted, and Windows environments; consider it when those platform choices better fit your deployment.
Tsurugi Linux is a free 64-bit Linux distribution provided as-is without warranty; consider it when a forensic Linux distribution is the need.
Volatility 3 is a free and open-source framework available for download on GitHub; consider it when that framework is a better fit for the task.

Verdict

Choose Arkime if your team needs flexible network capture and searchable session investigation and can operate its Linux and OpenSearch or Elasticsearch infrastructure. Its strongest reason to choose it is the combination of configurable packet retention, session search, and enrichment without license fees. Look elsewhere if you need traffic decryption, a managed service, or a tool that works without a separate search database.

	Arkime	Belkasoft X Forensic
Free plan	Yes	No
Free trial	No	No
Paid from	Free	—
Open source	No	No
Platforms	api, Linux, self-hosted, Web	Windows
Free plan	Yes	No

Arkime vs Belkasoft X Forensic

Arkime

Belkasoft X Forensic