Arkime Full Packet Capture Guide

When an alert fires on a network connection, responders need the packets that were actually exchanged, and most organisations either keep no full packet capture or keep PCAP files nobody can search. Arkime is an open source, Apache 2.0 licensed system that captures traffic, writes it to standard PCAP files and indexes session metadata in OpenSearch or Elasticsearch so analysts can search, pivot and retrieve packets through a web interface. This guide explains the components, defender use cases, how to size and secure a deployment, the retention trade-offs, and when another tool fits better. It goes deeper on one platform than the Network Monitoring and Packet Capture Guide and is written for network security engineers, SOC analysts and DFIR teams. Settings and sizing figures were checked against the Arkime documentation, FAQ and repository on 27 October 2026.

Key takeaways

Two stores, two retention clocks. PCAP stays on sensor disks and is deleted automatically as space runs out; session metadata (SPI data) lives in OpenSearch or Elasticsearch and is not deleted unless you configure index lifecycle policies or db.pl expire.
Disk is the limit. Arkime's FAQ estimates about 11 TB per day for 1 Gbps of uncompressed traffic; retention in days is simply disk divided by daily volume.
Arkime holds everything that crossed the wire. Credentials in clear-text protocols, personal data and file transfers end up in PCAP, so the platform needs the same access control and audit as any sensitive data store.
Change the defaults. passwordSecret defaults to password and also becomes the server-to-server secret; set strong values, enable TLS with certFile and keyFile, and restrict ports 8005 and 9200.
Check for drops before trusting absence. A sensor dropping packets produces a convincing but incomplete record; monitor the stats page and capture log continuously.

What the tool does

Arkime was created to replace commercial full packet systems at AOL in 2012. It is passive: it sits alongside your IDS and SIEM, fed by a network tap or SPAN port, and can store full packets or metadata only. The project site announces Arkime 6 as the current major release, and the FAQ already documents Arkime 7.x requirements (Node.js 24, upgrade from 6.5.0 or later), so check the release notes before upgrading.

Component	Role	Notes
capture	Threaded C application that monitors interfaces, writes PCAP to local disk, parses packets and sends session metadata to the search cluster	Reads with `tpacketv3` (recommended), `afpacketv3`, `libpcap`, `pfring`, `daq` and others
viewer	Node.js web application on each capture host; serves the interface and transfers packets	Listens on `viewPort` 8005 by default for users and inter-node proxying
OpenSearch or Elasticsearch	Indexes session metadata for search	FAQ lists OpenSearch 1.x to 3.x and Elasticsearch 8.x and 9.x for Arkime 7.x
WISE	Enrichment service that tags sessions from threat intelligence and asset data	Slow WISE responses can cause packet drops
Parliament	Dashboard grouping clusters and showing health and issues	Use it for sensor health monitoring
Cont3xt	Indicator enrichment from sources such as VirusTotal, Censys and Shodan	Sends indicators to external services; govern its use

The viewer's Sessions, SPI View, SPI Graph and Connections pages let analysts search with expressions over fields such as IP, port, protocol, host name and tags, then open or download the packets for any session in Wireshark. See the Wireshark for Security Analysis Guide.

Defender use cases

Use case	How Arkime helps	Related ATT&CK technique
Alert triage	Pull the exact session behind an IDS or EDR network alert and confirm what was sent	T1071.001 Web Protocols
Command and control hunting	Search for periodic connections, rare destinations and unusual protocol on port combinations in SPI Graph	T1071.004 DNS, T1572 Protocol Tunneling
Exfiltration scoping	Sum bytes by destination and session to estimate what left and when	T1041 Exfiltration Over C2 Channel, T1048 Exfiltration Over Alternative Protocol
Lateral movement reconstruction	Trace internal SMB, RDP and remote management sessions between hosts where internal traffic is captured	T1021.002 SMB/Windows Admin Shares
Retrospective hunting	Search metadata for a new indicator going back as far as SPI data is retained	All network-visible techniques
Evidence for reports	Export PCAP for specific sessions with a recorded query, preserving original packets	Supports NIST CSF 2.0 RS.AN-03

Encrypted traffic limits payload visibility, but session metadata (endpoints, timing, volume, TLS handshake details) still supports most hunting. Arkime complements a flow and protocol log tool such as Zeek and a signature engine such as Suricata rather than replacing them. See the Zeek Network Monitoring Guide, the Suricata IDS Guide and the Network Forensics Guide.

Deployment and safe use

Sizing

Item	FAQ guidance	Planning implication
Capture host	64 to 96 GB RAM, at least 2 x 6 cores, 16 or more 16 TB SATA drives, 10G NICs	One sensor per major choke point; disk dominates cost
Disk throughput	Disk write speed is usually the bottleneck; stay under about 80% of maximum (about 60% for RAID)	Benchmark disks before go-live
Daily volume	About 11 TB per day for 1 Gbps uncompressed	Measure your real average, not link speed
Search cluster disk	About 5% of PCAP storage for the same retention	Plan SPI retention longer than PCAP retention
Search cluster heap	At least 1% of stored data as heap (7 TB needs about 70 GB)	Several nodes at about 30 GB memory plus 30 GB disk cache each
Separation	`pcapDir` and the search data directory must not share a file system	Separate volumes or hosts

Configuration that matters

Retention: freeSpaceG (default 5%) sets the free space the viewer maintains on pcapDir by deleting the oldest PCAP; session records remain. Set an ILM or ISM policy, or db.pl expire, for SPI data to match your retention policy.
File rotation: maxFileSizeG (default 12 GB since 4.0.0) and maxFileTimeM (default 0, size only) control PCAP file size and age; the disk needs at least ten times maxFileSizeG free.
Reduce what you keep: bpf filters traffic before processing; dontSaveBPFs and dontSaveTags stop saving the rest of a session after its first packets, which is the usual way to drop bulk encrypted streaming or backup traffic while keeping metadata.
Write method: pcapWriteMethod defaults to simple; simple-nodirect for ZFS or NFS, s3 for object storage, null for metadata only.
Authentication: authMode supports digest (the default when empty), basic, form, header, header-jwt, OIDC and others. Prefer OIDC or header authentication behind your identity provider so analysts use named accounts with MFA.
Roles: Arkime uses role-based permissions; Arkime 7 requires the arkimeUser role for any viewer access and moves search cluster administration to a dbAdmin role. Give PCAP download only to those who need it.

Hardening

Set secrets: replace the default passwordSecret (default password) and set a distinct serverSecret; restrict config.ini file permissions.
Enable TLS: set both certFile and keyFile, otherwise the viewer serves HTTP; use TLS and authentication (users or API keys) to the search cluster too.
Isolate the network: expose 8005 only to analyst networks and other viewers, and 9200 to 920x only to Arkime nodes. The capture interface should have no IP address.
Govern enrichment: decide which indicators Cont3xt and WISE may send to external services.
Audit access: log who searched and downloaded which sessions, and review it; the history of analyst queries is itself sensitive.
Test and roll back: stage upgrades on one sensor, check the stats page and capture log, then roll out; keep the previous package and configuration to revert.

Legal and privacy review is part of deployment: full packet capture of employee traffic is regulated in many jurisdictions, and captured data may need to be produced in litigation. Document the purpose, retention and access rules before switching it on.

Detection and hardening value

Monitoring sensor health

Stats page: /stats?statsTab=1 on the viewer; the FAQ flags low packet counts on a node, timestamps more than 5 seconds old, and Disk Q or ES Q above 50 as problems.
Capture log: arkime_packet_log lines in capture.log should show packet counts above zero.
Disk I/O: iostat -xm 5 with queue size near 1 and await near 10 or below.
Common drop causes: reader choice, NIC offload settings, interface MTU below 1600, wrong packetThreads, slow disks and slow WISE.

Where identity fits

Packet capture exposes credentials in protocols that still send them in clear text or in weakly protected forms (legacy HTTP basic authentication, FTP, Telnet, LDAP simple binds, SNMP community strings), and often reveals service accounts and API keys used by scripts and appliances. Search Arkime for these protocols, record every credential observed, rotate it and move the integration to an encrypted, ideally token-based, alternative. Protecting the PCAP store is part of protecting those identities. See the Service Account Security Guide.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-53 Rev. 5	SI-4, SC-7, AU-9, AC-6	System monitoring, boundary protection, protecting captured records, least privilege for analysts
NIST CSF 2.0	DE.CM-01, RS.AN-03	Network monitoring and incident analysis
CIS Controls v8.1	Control 13 Network Monitoring and Defense	See the CIS Control 13 Network Monitoring and Defense Guide
MITRE D3FEND	D3-NTA Network Traffic Analysis, D3-PHDURA Per Host Download-Upload Ratio Analysis	Defensive techniques Arkime data supports

Measuring the capability

Coverage: percentage of internet egress and key internal segments captured.
PCAP and SPI retention: days of each actually available, checked weekly against policy.
Drop rate: packets dropped as a percentage of received, per sensor, target below 0.1%.
Alert-to-packet time: minutes from alert to the analyst viewing the session.
Clear-text credential findings: count per quarter, trending to zero.

Common failure patterns

Retention mismatch: PCAP rolls over in four days while the investigation needs three weeks; size for your dwell-time assumptions.
Unbounded SPI growth: nobody configured ILM or db.pl expire, and the search cluster fills and stops indexing.
Default secrets and HTTP: the viewer is reachable on 8005 without TLS and with a default passwordSecret.
Silent drops: a sensor saturates during an incident peak and the gap is read as "no traffic".
Edge-only capture: no internal visibility, so lateral movement cannot be reconstructed.

Alternatives

Option	Choose it when	Trade-off
Arkime	You want searchable full packet capture at scale, open source	Significant disk and search cluster cost; you operate it
Zeek logs only	Long retention of protocol metadata at low storage cost	No packets to confirm payloads
Suricata with conditional PCAP	Packets only for alerting sessions	Nothing for sessions that did not alert
Rolling tcpdump or ring buffers	Small sites, short retention	No index; slow to search
Cloud traffic mirroring and flow logs	Cloud workloads	Mirroring cost and limits; flow logs lack payload
Commercial NDR or packet capture appliances	Supported product with built-in analytics	Licence cost and vendor dependence

A small organisation may run one Arkime sensor with a single-node search cluster at the internet edge; large organisations run sensors per site or data centre with a shared search cluster and Parliament for health.

Practitioner checklist

Agree purpose, retention and access rules with legal and privacy before capture starts.
Size sensor disks from measured traffic and target PCAP retention; size the search cluster for longer SPI retention.
Configure freeSpaceG and an ILM or ISM policy (or db.pl expire) for SPI data.
Replace default secrets, enable TLS on the viewer and search cluster, and restrict ports 8005 and 9200.
Integrate authentication with your identity provider and assign least-privilege roles.
Use dontSaveBPFs or dontSaveTags to cut bulk encrypted traffic while keeping metadata.
Monitor drops, queue depth and stale timestamps on every sensor.
Search regularly for clear-text credentials and rotate any found.

Arkime Full Packet Capture Guide: Deploying Indexed PCAP for Network Forensics