arkime/arkime

Arkime is a large scale, open-source network analysis and full packet capture system. It augments existing security infrastructure by storing and indexing network traffic in standard PCAP format, providing fast, indexed access. Arkime features an intuitive web interface for PCAP browsing, searching, and exporting, and offers APIs that allow direct consumption of PCAP data and JSON-formatted session metadata. It is built to scale across many systems, handling tens of gigabits per second of traffic, with PCAP retention controlled by sensor disk space and metadata retention managed via an OpenSearch/Elasticsearch cluster. The system comprises three main components: capture (a threaded C application), viewer (a Node.js web interface), and OpenSearch/Elasticsearch. Optional components include cont3xt for contextual intelligence, esProxy for extra security, Parliament for monitoring multiple clusters, and wiseService for threat intelligence integration. Originally created to replace commercial full packet systems at AOL, Arkime provides a cost-effective, fully controllable full packet capture solution.