Arkime
Arkime: A server-based Arkime system for searchable packet investigations and session analysis. Ranked #6 of 30 in Network Protocol Analyzers by our editors (8.7/10); pricing: Free plan; best for searchable, server-based packet investigations.
At a glance
- Editor score8.7 / 10
- PricingFree plan
- Best forSearchable, server-based packet investigations
- Free planYes
- Paid fromFree
- DeploymentServer
- Founded2012
- Facts checked20 Sep 2026
Where it wins
- Combines live capture with offline PCAP import and processing
- Searches session metadata and protocol fields through a web interface
- Supports PCAP retention, export, flow views, and remote capture
Where it doesn't
- Requires server deployment and self-hosted operation
- Encrypted TLS traffic is indexed as ciphertext without decryption support
- OpenSearch or Elasticsearch is required for indexed session data
Our verdict on Arkime
Arkime is a self-hosted, open-source network analysis and session search system for security teams and network operators. It runs on Linux with web, API, and server deployment options. The system can capture traffic from live network interfaces, process offline PCAP files, extract searchable session metadata and protocol fields, and retain packets in standard PCAP format. It suits teams that need centralized investigations across captured traffic rather than a desktop-only packet inspection tool.
Its strongest capability is the combination of searchable metadata and packet-level investigation. Arkime provides session search, session detail, packet inspection, timeline analysis, SPI views, graphs, connection graph visualization, and PCAP or CSV export. Teams can choose full or selective PCAP retention, use Arkime as a metadata engine, or combine metadata with packet capture. Remote capture via TZSP and PCAP-over-IP extends collection beyond the primary server, while command-line capture and command-socket control support operational workflows.
Arkime is free and open source, with deployment centered on a server environment and indexing through OpenSearch or Elasticsearch. That makes it a fit for organizations prepared to operate its infrastructure and manage retention and search components. Its main boundary is encrypted traffic: decryption support is false, and encrypted TLS traffic is otherwise stored and indexed as ciphertext. The documentation describes TLS decryption through an external PolarProxy workflow. Choose Arkime for searchable, server-based investigations that need live and offline capture, retention controls, and flow analysis. Choose an alternative when native decryption is a core requirement or when a self-hosted server architecture is not suitable.
Your product? Our editors can test Arkime in depth and publish a review, labelled as paid · from $149/mo →
Arkime pricing
Arkime fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Deployment | Server |
| Capture sources | Both |
| PCAP support | Yes |
| Traffic decryption | No |
| CLI tools | Yes |
| Remote capture | Yes |
| Flow analysis | Yes |
| Deployment | Self-hosted |
| Platforms | Web, Linux |
| Support | Community, Docs |
| Built for | Mid-market, Enterprise (editorial estimate) |
| Integrations | 2 integrations: OpenSearch, Elasticsearch |
| Pricing | Free plan |
| Website | arkime.com |
| Facts checked | 20 Sep 2026 |
Arkime integrations
Arkime lists 2 integrations on its own site.
- OpenSearch
- Elasticsearch
Alternatives to Arkime
- WiresharkA broad, free desktop analyzer for live captures, PCAP files, filtering, and protocol inspection.9.4
- TSharkA free, scriptable Wireshark-based analyzer for live captures, PCAP files, and protocol workflows.9.2
- ScapyA free, programmable toolkit for crafting, capturing, decoding, and analyzing packets.9.0
Arkime vs the competition
- Arkime vs Wireshark
- Arkime vs TShark
- Arkime vs Scapy
- Arkime vs Kismet
- Arkime vs tcpdump
- Arkime vs Ettercap
Compare Arkime with any tool side by side →
Also Ranked In
Arkime is ranked in 4 of our directories.
Used Arkime? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Arkime for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Arkime is listed in our Network Protocol Analyzers directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/arkime/"><img src="https://www.itechguides.com/best/badge/arkime.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update