01 · Product name
Arkime
Index packets you capture. Demo asks for Google.
Published by Arkime.
In short
Arkime is the open-source packet index. The homepage on 18 Oct 2026 says Arkime 6 is available and describes full PCAP or metadata-only session records in OpenSearch or Elasticsearch. The GitHub SPDX field is Apache-2.0. The public demo at demo.arkime.com/sessions asked for a Google sign-in and did not show a session list. This listing did not sign in and did not deploy a sensor. A session record is the parser's view of a flow you are allowed to watch.
Product pricing strategy
02
Free
arkime.com does not print a price for the software. The SPDX field is Apache-2.0. The demo asked for a Google sign-in and did not show a paid plan. Elasticsearch or OpenSearch, disk for PCAP, and the machines that run the sensor are your costs, and this page does not price them. Do not invent a per-gigabyte Arkime fee. If a company sells a managed Arkime, cite that offer. The license line for the code this listing is talking about is Apache-2.0.
Utility and features
03
The Arkime site describes a system that sits beside an IDS and a SIEM, parses layers 3 through 7, and indexes fields such as DNS names, HTTP headers, TLS fingerprints, and file hashes. It says you can store full packets or only the session metadata, and that Arkime Rules choose what is kept as PCAP. The sessions page, the SPI view, the SPI graph, and a connections graph are described on that homepage. The version banner says Arkime 6.
- Arkime 6, on the homepage. The site's banner says Arkime 6 and describes session search plus optional PCAP.
- Apache-2.0. The GitHub SPDX field on arkime/arkime is Apache-2.0. The homepage did not print a price.
- Demo requires Google. demo.arkime.com/sessions showed a sign-in page. No session list was opened.
The demo URL linked from the site, demo.arkime.com/sessions, loaded a sign-in page for Arkime 6 Demo that requires a Google account. No session table was visible. This listing did not authenticate. The Screenshots section is removed. Apache-2.0 is the SPDX field on arkime/arkime. That license is not a hosted account. Running Arkime means a capture process, OpenSearch or Elasticsearch, and a viewer. This listing started none of those. Do not describe a homepage diagram as a capture you made.
- 1
Read the homepage for the retention choice, full PCAP or metadata, before you size disk.
- 2
Treat the demo sign-in as a wall, not as a result set.
- 3
When you do run a sensor, export a PCAP only for traffic you are allowed to keep.
Caveats
04
The demo wall is not a session. There is no DNS name, JA4, or PCAP export from this listing to quote. Homepage descriptions of the sessions page are the project's documentation of the UI, not a screenshot filed here.
Arkime 6 is the banner on the homepage. This listing did not read a version command from a local install. Full PCAP and metadata-only mode are different retention choices the page describes. Do not say you stored packets if you only indexed metadata. Capturing traffic requires authority on that network. Opening the marketing page does not grant it.
Potential use cases
06
- You are choosing retention before you buy disk. The homepage on 18 Oct 2026 says Arkime 6 can keep full PCAP or only session metadata in OpenSearch or Elasticsearch, and that Arkime Rules choose what is stored. Those are different disk plans. This listing did not deploy a sensor and does not know your capture rate.
- The public demo is offered as proof of a session. demo.arkime.com/sessions loaded a sign-in page for the Arkime 6 demo and asked for a Google account. No session table was visible. This listing did not authenticate. Do not describe a DNS name, a JA4, or a PCAP export from a page that asked you to sign in.
- The license is about to be turned into a hosted account. The GitHub SPDX field on arkime/arkime is Apache-2.0. The homepage did not print a price. Elasticsearch or OpenSearch and the capture machines are your costs, and this page does not price them. A managed offer, if you find one, is a different invoice.
Hard cases
The case where the first result is easy to over-read.
The sign-in page is called a result
The sessions URL showed Arkime 6 Demo and a Google sign-in. It did not show packets. Homepage diagrams of the sessions page are the project's description of the UI. They are not a capture filed here. Full PCAP and metadata-only mode stay separate until a sensor you run writes one of them.
Practitioners using it
Posts on X from people describing a concrete use. The quote is the post. Likes and reposts are the counts saved with it, not a live total. A label marks a creator, a maintainer, a vendor, a partner, a data partner, or an investor.
Partner
Capture Decrypted TLS Traffic with ̶M̶o̶l̶o̶c̶h̶ Arkime using PolarProxy #howto #pcap 🦉➕🐻❄️ https://t.co/RIolfbYQvu pic.twitter.com/c5eCHWQM2R
did my first @pluralsight lab today, it was pretty bad ass. got to import a pcap into Arkime, find a bad file, write a couple of @Suricata_IDS rules, one on the hash of said file, run suricata with custom rules created and see alert pop off (send alert to moloch as well...)
#PCAP file analysis for #EMOTET #Malware using #OpenSource tool #arkime soon InshAllah will be added to #ELK_DFIR_VM , Network #Forensics #DFIR pic.twitter.com/E1MQMtWQCd
Partner
. @andywick + Elyse Rinne demo @arkime_fpc , an open source full packet capture system that uses #Elasticsearch for meta data storage. Arkime is used by @verizonmedia + others to protect the network for a fraction of the cost of a commercial full packet capture system. #ElasticCC pic.twitter.com/s1HeuMQOXU
Questions
Is Arkime free?
The homepage does not print a price. The GitHub SPDX field is Apache-2.0. The public demo required a Google sign-in and did not show a rate card.
Did the demo show packets?
No. The sessions URL loaded a sign-in page for the Arkime 6 demo. This listing stopped there.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Arkime homepage
https://arkime.com/Documentation
Arkime repository
https://github.com/arkime/arkime