Arkime: Full Packet Capture You Can Actually Search
Arkime, formerly Moloch, captures full network packets and indexes them so you can find specific traffic later. It is the tool for the situation where logs tell you something happened and you need the actual bytes.
The distinction
Zeek tells you a connection occurred and describes it. Suricata tells you it matched a rule.
Arkime keeps the packets. When you need to know exactly what was transferred rather than that a transfer happened, nothing else answers the question.
How it works
Three components: a capture process writing packets to disk and metadata to OpenSearch, the search interface, and the datastore.
The search interface is what makes it usable. Query by address, port, protocol, hostname, certificate details, or country, narrow to a time window, and download the matching sessions as a pcap for analysis in Wireshark.
Storage is the constraint
This is the honest limitation. Full packet capture on a busy link consumes storage fast, and the amount of history you keep is a direct function of disk.
Arkime handles this with rolling deletion of the oldest packets while keeping metadata longer, so you retain a searchable record of what happened for far longer than you retain the packets themselves. That is usually the right compromise: a month of metadata and a week of packets is more useful than a week of both.
Sizing is arithmetic. Measure your average throughput, decide your retention, multiply.
Reasonable deployments
A homelab capturing at the internet edge, where throughput is modest and a few terabytes buys real history.
Not an attempt to capture a busy internal network without planning storage first.
Filtering at capture reduces volume considerably. Excluding known-bulk traffic like streaming video keeps the interesting traffic and discards what you will never investigate.
Complementary tools
The common arrangement is all three: Zeek for structured logs, Suricata for signature alerts, Arkime for the packets. Alerts point at a time and address, logs give context, packets give proof.
For ad hoc capture rather than continuous, tcpdump is the right tool and requires no infrastructure.
License
Arkime is released under the Apache License 2.0.