Blab Tech
Arkime 6.7.0 Released: Open-Source Packet Capture System Scales to Tens of Gigabits per Second
On August 20 2026, the Arkime project unveiled version 6.7.0, a polished update that tightens performance and expands functionality for the open‑source packet‑capture platform that has become indispensable in high‑volume network monitoring.
Arkime—formerly Moloch—captures every packet, stores it in standard PCAP files, and indexes the metadata in an OpenSearch or Elasticsearch cluster. Designed to run across multiple sensors, the system can ingest traffic at tens of gigabits per second, a throughput that makes it viable for both enterprise networks and service‑provider backbones.
The core Arkime stack is split into three tightly coupled components:
1. capture – a multi‑threaded C program that writes PCAPs to disk, parses packets in real time, and pushes session metadata to the search backend. 2. viewer – a Node.js web application that listens on port 8005 and streams packet data to browsers. 3. OpenSearch/Elasticsearch – the search database that stores session metadata and powers fast queries.
Optional add‑ons extend the platform’s capabilities. cont3xt supplies contextual intelligence for investigations; esProxy provides a security layer between capture and the search cluster; Parliament offers a front‑door for managing multiple Arkime clusters; and wiseService injects threat‑intelligence data into session records.
Arkime’s roots trace back to 2012 at AOL, where the team replaced expensive commercial full‑packet systems with Arkime to achieve the same coverage at a fraction of the cost. The same cost‑effective, scalable model now serves any organization that needs to retain and analyze all network traffic.
Installation remains straightforward. Users can download prebuilt binaries from the Arkime website or pull official Docker images. For those who prefer source, the GitHub repository contains an easybutton-build.sh script that automates configuration and compilation. The primary configuration file, "/opt/arkime/etc/config.ini", holds every tunable setting—from retention policies and port numbers to TLS options.
Retention is flexible: packet data lives on sensor disks until space is exhausted, while metadata retention is governed by the size of the Elasticsearch cluster. Both layers can be expanded on demand, giving administrators full control over storage costs.
Security is baked into the stack. The viewer can be served over TLS, and authentication may be handled via HTTPS with digest passwords, an external web‑server proxy, or OpenSearch/Elasticsearch user authentication and API keys. A shared password stored in the config file encrypts password hashes and secures inter‑component communication.
The web interface offers a Sessions page that lists individual flows, a SPI View that dissects all recognized fields, and export options for PCAP and JSON session data. APIs are available for programmatic access, enabling integration with other security tools or custom dashboards.
Arkime is distributed under the Apache 2.0 license, and its active community engages on Slack. Contributors are encouraged to file issues, submit pull requests, or improve documentation on GitHub.
In sum, Arkime 6.7.0 delivers a robust, scalable packet‑capture solution that can be deployed across many sensors, indexed by OpenSearch or Elasticsearch, and accessed through a simple web UI or APIs. Its open‑source nature, coupled with flexible retention and security options, makes it a compelling alternative to commercial full‑packet systems for any organization seeking comprehensive network visibility.
Future releases are slated to refine performance, broaden optional add‑ons, and deepen integration with threat‑intelligence feeds, but the core architecture remains unchanged. For now, Arkime continues to provide a cost‑effective, high‑throughput packet‑capture platform for network analysts and security teams worldwide.
Arkime—formerly Moloch—captures every packet, stores it in standard PCAP files, and indexes the metadata in an OpenSearch or Elasticsearch cluster. Designed to run across multiple sensors, the system can ingest traffic at tens of gigabits per second, a throughput that makes it viable for both enterprise networks and service‑provider backbones.
The core Arkime stack is split into three tightly coupled components:
1. capture – a multi‑threaded C program that writes PCAPs to disk, parses packets in real time, and pushes session metadata to the search backend. 2. viewer – a Node.js web application that listens on port 8005 and streams packet data to browsers. 3. OpenSearch/Elasticsearch – the search database that stores session metadata and powers fast queries.
Optional add‑ons extend the platform’s capabilities. cont3xt supplies contextual intelligence for investigations; esProxy provides a security layer between capture and the search cluster; Parliament offers a front‑door for managing multiple Arkime clusters; and wiseService injects threat‑intelligence data into session records.
Arkime’s roots trace back to 2012 at AOL, where the team replaced expensive commercial full‑packet systems with Arkime to achieve the same coverage at a fraction of the cost. The same cost‑effective, scalable model now serves any organization that needs to retain and analyze all network traffic.
Installation remains straightforward. Users can download prebuilt binaries from the Arkime website or pull official Docker images. For those who prefer source, the GitHub repository contains an easybutton-build.sh script that automates configuration and compilation. The primary configuration file, "/opt/arkime/etc/config.ini", holds every tunable setting—from retention policies and port numbers to TLS options.
Retention is flexible: packet data lives on sensor disks until space is exhausted, while metadata retention is governed by the size of the Elasticsearch cluster. Both layers can be expanded on demand, giving administrators full control over storage costs.
Security is baked into the stack. The viewer can be served over TLS, and authentication may be handled via HTTPS with digest passwords, an external web‑server proxy, or OpenSearch/Elasticsearch user authentication and API keys. A shared password stored in the config file encrypts password hashes and secures inter‑component communication.
The web interface offers a Sessions page that lists individual flows, a SPI View that dissects all recognized fields, and export options for PCAP and JSON session data. APIs are available for programmatic access, enabling integration with other security tools or custom dashboards.
Arkime is distributed under the Apache 2.0 license, and its active community engages on Slack. Contributors are encouraged to file issues, submit pull requests, or improve documentation on GitHub.
In sum, Arkime 6.7.0 delivers a robust, scalable packet‑capture solution that can be deployed across many sensors, indexed by OpenSearch or Elasticsearch, and accessed through a simple web UI or APIs. Its open‑source nature, coupled with flexible retention and security options, makes it a compelling alternative to commercial full‑packet systems for any organization seeking comprehensive network visibility.
Future releases are slated to refine performance, broaden optional add‑ons, and deepen integration with threat‑intelligence feeds, but the core architecture remains unchanged. For now, Arkime continues to provide a cost‑effective, high‑throughput packet‑capture platform for network analysts and security teams worldwide.
