Alternatives to Arkime
Store and search captured network traffic through a web interface. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Arkime
Store and search captured network traffic through a web interface.
Replacements
Listings that take over the same core job as Arkime.
Malcolm
A self-hosted network traffic analysis suite that turns PCAP files, Zeek logs and Suricata alerts into searchable dashboards.
Malcolm bundles Arkime with Zeek, Suricata and OpenSearch dashboards in one self-hosted stack, adding detection data at the cost of a large multi-container deployment needing substantial resources.
Security Onion
A free Linux distribution for network security monitoring, packet capture, detection and threat hunting.
Security Onion is a Linux distribution installed from one ISO that adds detection rules and threat hunting to packet capture, but it needs dedicated hardware and is not open source.
Also worth comparing
These listings name Arkime as their own alternative, so the relationship runs both ways.
NetworkMiner
Network forensics tool that extracts files and credentials from captures.
Arkime stores and indexes captured sessions in PCAP for searching through a self-hosted web interface on Linux, suited to large captures that need substantial storage.
ntopng
Web-based network traffic probe that shows real-time and historical flows by host, protocol and application.
Arkime is free and open source under Apache-2.0, storing and indexing full packet captures for search, which needs substantial storage instead of ntopng's flow and application views.
Similar software
Related functionality, not a direct replacement.
Wireshark
The network protocol analyser: capture traffic and read it packet by packet, with dissectors for hundreds of protocols.
tcpdump
The classic command-line packet capture and analysis tool.
Termshark
Terminal interface for tshark that feels like Wireshark.
Sniffnet
Shows what your machine is actually talking to, with charts instead of a wall of packets.
RITA
A network traffic analysis framework that detects command and control communication such as beaconing.
