Quick start: Deploy Arkime Network Monitoring in 5 Minutes
On Ubuntu 22.04 or 24.04, the fastest approach is to install Arkime’s prebuilt binary package alongside a single-node OpenSearch cluster on the same host.
Step 1: Set up OpenSearch as the metadata storage backend
Arkime requires OpenSearch to index captured data fields. Prepare the environment and install OpenSearch as follows:
# Install prerequisite packages
sudo apt update && sudo apt install -y curl wget libpcap-dev libssl-dev
# Add the official OpenSearch 2.x repository
curl -o- https://artifacts.opensearch.org/publickeys/opensearch.pgp | sudo gpg --dearmor -o /usr/share/keyrings/opensearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring.gpg] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main" | sudo tee /etc/apt/sources.list.d/opensearch-2.x.list
sudo apt update && sudo apt install -y opensearch
# Disable internal security plugin for local testing to avoid self-signed SSL issues
echo "plugins.security.disabled: true" | sudo tee -a /etc/opensearch/opensearch.yml
# Start OpenSearch
sudo systemctl enable --now opensearch
curl -s -X GET "http://localhost:9200"Step 2: Install Arkime and configure the network interface
# Download the latest Arkime package for Ubuntu 22.04
wget https://s3.amazonaws.com/files.molo.ch/builds/ubuntu-22.04/arkime_5.4.0-1.ubuntu2204_amd64.deb
sudo dpkg -i arkime_5.4.0-1.ubuntu2204_amd64.deb
# Run the configuration wizard
sudo /opt/arkime/bin/ConfigureThe installer wizard will prompt you for three main pieces of information:
- Network interface to monitor: Enter the network interface you want to capture traffic on (e.g.,
eth0orens18). - Elasticsearch server: Keep the default
http://localhost:9200. - Password to encrypt SGMAC with: Enter a random password string to encrypt session cookies.
Step 3: Initialize the database, create an admin user, and start services
# Initialize the index schema in OpenSearch
sudo /opt/arkime/db/db.pl http://localhost:9200 init
# Create a web interface administrator account
sudo /opt/arkime/bin/arkime_add_user.sh admin "Admin User" P@ssw0rd123Secured --admin
# Enable and start capture daemon and web viewer
sudo systemctl enable --now arkimecapture
sudo systemctl enable --now arkimeviewerOpen your browser and navigate to http://SERVER_IP:8005, then sign in with the admin credentials you just created. After about 10 to 30 seconds, the Sessions tab will display live packet streams flowing across your interface.
What Real-World Problem Does Arkime Solve?
Firewalls and Intrusion Detection Systems (IDS) act like burglar alarms on your front door. They sound the alarm when someone picks the lock or knocks aggressively. But once the intruder enters, which rooms did they ransack? Which files did they exfiltrate? What trojans did they plant? Traditional IDS cannot tell you.
Arkime (formerly Moloch) functions as a continuous, high-definition CCTV security system for your network. It captures every single byte traveling across the wire—a capability known as Full Packet Capture (FPC). Raw network frames are written directly to disk without dropping a packet.
Back when I was on ops duty, one of my servers was hit by an SSH brute-force attack at 2 AM. The auth log only showed thousands of failed login attempts from a foreign IP. But the critical question remained: Did the attacker crack any password? Did they manage to pull down malicious scripts? Plain text logs couldn’t answer that. With Arkime, you simply open that session, replay the keystroke stream, and see exactly what happened on the attacker’s shell.
Three Core Architectural Components of Arkime
- Capture Engine (arkimecapture): Written in pure C, directly bound to the network interface in promiscuous mode. This process continuously parses packets, extracts metadata (IP, port, SSL certificate, DNS query, HTTP headers), and writes raw bytes into sequential
.pcapfiles. - Database Index (OpenSearch / Elasticsearch): Stores all indexed metadata. Thanks to distributed search indices, you can pinpoint a specific connection out of tens of millions of packets in under a second.
- Viewer (arkimeviewer): A Node.js web application. Viewer reconstructs entire TCP/UDP streams (Session Reconstruction), unpackages payloads, extracts HTTP image transfers, and lets you download raw
.pcapsegments to analyze locally in Wireshark.
Using Arkime for Real-World Incident Investigation
1. High-speed filtering using SPI query syntax
Arkime’s Search Protocol Index (SPI) bar enables lightning-fast data exploration without sifting through walls of raw logs:
# Capture HTTP traffic running on non-standard ports (other than 80, 443, and 8080)
protocols == "http" && port.dst != 80 && port.dst != 443 && port.dst != 8080
# Find DNS queries for dynamic DNS domains or commonly abused code-sharing services
host.dns == "*pastebin*" || host.dns == "*ngrok*" || host.dns == "*.duckdns.org"
# Hunt for internal SSH scanning with abnormally high frequency
protocols == "ssh" && ip.src == 192.168.1.0/24 && packets > 100 && bytes < 50002. Replay connection sessions and extract binaries
Click the + icon at the start of any session, and Arkime reconstructs scattered packets into an intelligible conversation thread. Outbound client data appears in red, while server responses are highlighted in blue.
Suppose an attacker downloads a malicious shell script onto your host via unencrypted HTTP using curl. Simply switch to the Files tab within that session and download the raw binary directly for sandbox analysis or reverse engineering—no manual packet carving required.
3. Configure retention policies to avoid running out of disk space
Packet capture consumes storage rapidly. A fully saturated 100 Mbps link can easily ingest over 1 TB of disk space daily. Without automated rotation policies, full disks will inevitably crash services.
Open /opt/arkime/etc/config.ini and configure the retention thresholds:
# Directory to store raw pcap files
pcapDir = /opt/arkime/raw
# Keep at least 15% free disk space; below this threshold, the oldest pcaps are deleted
freeSpaceG = 15%
# Cap each PCAP file at 8 GB before rotating to prevent I/O bottlenecks
maxFileSizeG = 8Save the file and restart the capture daemon to apply changes:
sudo systemctl restart arkimecaptureProduction Engineering Best Practices
Tuning network interfaces against packet drops
During traffic bursts, network card hardware queues frequently overflow. Consequently, packets get dropped before reaching Arkime’s capture pipeline. Use ethtool to maximize ring buffers and turn off hardware offloading:
# Maximize RX/TX ring buffers to hardware limits (typically 4096)
sudo ethtool -G eth0 rx 4096 tx 4096
# Disable offloading so Arkime inspects actual wire frames instead of aggregated packets
sudo ethtool -K eth0 tso off gso off gro off lro offStorage capacity planning formula
Avoid trying to store raw PCAP data for an entire year. In practical incident response, the most valuable forensic window spans 7 to 14 days.
For an office or server cluster averaging 50 Mbps bandwidth:
- 50 Mbps equals roughly 6.25 MB of data per second.
- Continuous capture generates approximately 500 GB to 540 GB of raw PCAP files per day.
- To retain 7 days of rolling data, provision a RAID array with at least 4 TB of usable storage. Ideally, split storage tiers: use NVMe SSDs for OpenSearch to maintain snappy queries, and enterprise HDDs for raw PCAP archives.
Securing the Web Viewer with an Nginx reverse proxy
By default, Arkime Viewer serves unencrypted HTTP on port 8005. Exposing this port directly to the internet is a severe vulnerability that exposes sensitive internal traffic.
Block port 8005 at the firewall, terminate TLS through Nginx with valid SSL certificates, and restrict access to SOC or engineering IP ranges:
server {
listen 443 ssl http2;
server_name arkime.internal.lan;
ssl_certificate /etc/ssl/certs/arkime.crt;
ssl_certificate_key /etc/ssl/private/arkime.key;
# Restrict access to engineering / SOC IP range
allow 192.168.10.0/24;
deny all;
# Limit upload size for manual PCAP imports
client_max_body_size 500M;
location / {
proxy_pass http://127.0.0.1:8005;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_read_timeout 300s;
}
}During an incident, threat actors can purge logs or tamper with system alerts. However, raw packet data written to disk cannot be fabricated. Deploying Arkime gives you definitive, ground-truth evidence to identify where threats originated, what they touched, and what data left your perimeter.
