Arkime

Arkime was called Moloch until the project moved out of its original GitHub organisation and renamed itself, explaining on its site that the old name might send signals it did not intend. The code is under the Apache 2.0 licence. A capture process watches interfaces or reads existing capture files, parses traffic from layer 3 to layer 7, extracts fields for each session and writes the packets to disk in standard pcap form. Session metadata goes into OpenSearch or Elasticsearch. The viewer, a web application, offers Sessions, SPI View, SPI Graph and Connections pages for searching and drawing the data. Parliament gives a landing page and health view across several clusters and Cont3xt enriches indicators from outside sources. Arkime can run with metadata only, like an enhanced NetFlow, with selective capture driven by Arkime Rules or with full packet capture.

The forensic value is retention. A tcpdump file covers an hour. Arkime keeps whatever its disks allow and keeps it searchable, so when an alert arrives days late the analyst can still ask which hosts spoke to a given address on a given night and export the matching sessions as a pcap for Wireshark. A large capture set handed over by a client can be loaded into Arkime to make it searchable before anyone opens a single file. The project FAQ lists Amazon Linux 2023, Arch, Debian 12 and 13, Enterprise Linux 9 and 10, Ubuntu 22.04 and 24.04 and FreeBSD 14 and 15 as directly supported, with container images as well. Deployment is an infrastructure job: sizing the search cluster, the capture disks and the retention policy.