Chapter 61

Arkime Architecture

Arkime (formerly Moloch) is an open-source full-packet-capture platform that stores raw PCAP along with session metadata in Elasticsearch, and provides a web UI for searching and retrieving packets. Arkime bridges the gap between Zeek/Suricata (which provide metadata but not packets) and raw Wireshark analysis (which requires you to already have the right PCAP file). With Arkime, you search by IP, port, protocol, or content to find sessions, then download the PCAP for any matching session in seconds.

Scenario

A Zeek alert fires for a suspicious outbound TLS connection with a self-signed certificate. The analyst searches Arkime for sessions to the destination IP within the alert time window. Arkime returns 3 sessions. The analyst clicks "Download PCAP" on the suspicious one and opens it in Wireshark — all within 90 seconds of seeing the alert. Without Arkime, finding and retrieving the right PCAP from a multi-terabyte archive would take 30+ minutes.

Arkime Architecture

  Arkime Architecture
  ═══════════════════════════════════════════════════════════════════

  Capture layer:
  ├── arkime-capture process
  │     Reads from live interface (AF_PACKET) or PCAP files
  │     Performs TCP reassembly + protocol detection (DPI)
  │     Writes session metadata → Elasticsearch
  │     Writes raw packets → disk (PCAP storage)
  └── Stores PCAP in hourly rotated files:
        /data/pcap/YYYY/MM/DD/HHMM-interface.pcap

  Index layer (Elasticsearch):
  ├── Per-session index entry:
  │     src/dst IPs, ports, protocol
  │     timestamps (start, stop)
  │     byte counts, packet counts
  │     decoded protocol fields (HTTP URI, TLS SNI, DNS query)
  │     byte offsets into the PCAP file (for fast retrieval!)
  └── Full-text search across all indexed fields

  Viewer layer:
  ├── Node.js web application
  ├── Searches Elasticsearch for sessions matching query
  ├── Retrieves PCAP bytes from disk using stored offset+length
  ├── Reassembles session PCAP on demand
  └── Serves as downloadable .pcap or inline Wireshark viewer

  PCAP retrieval flow:
  1. User searches: ip==1.2.3.4 && port==443
  2. Elasticsearch returns matching sessions with file offsets
  3. Viewer reads bytes from PCAP files at those offsets
  4. Returns assembled PCAP for that session
  Time: <5 seconds for any single session, regardless of total archive size

Arkime Deployment

basharkime-deploy.sh

#!/bin/bash

echo "=== Download and configure Arkime ==="
ARKIME_VERSION="4.3.0"
wget "https://github.com/arkime/arkime/releases/download/v${ARKIME_VERSION}/arkime_${ARKIME_VERSION}-1.ubuntu2004_amd64.deb"
apt install -y "./arkime_${ARKIME_VERSION}-1.ubuntu2004_amd64.deb"

echo ""
echo "=== Configure Arkime ==="
cat > /opt/arkime/etc/config.ini << 'CONF'
[default]
# Elasticsearch connection
elasticsearch=http://elastic:9200

# PCAP storage directory (needs lots of space)
pcapDir=/data/pcap

# Capture interface
interface=eth0

# Max PCAP file size before rotation (500MB)
maxFileSizeG=0.5

# PCAP retention: delete oldest when disk > 80% full
freeSpaceG=10

# Password for web UI
passwordSecret=change_this_before_production

# Listener port for web viewer
viewPort=8005

# Elasticsearch index settings
# Rotate daily indexes
rotate=daily

# Session expiration (keep metadata N days)
# Keep longer than PCAP retention to know what happened even after PCAP purged
sessionTimeout=90d

# Fields to index (add protocol-specific fields here)
# HTTP
userField=http.user,user
# TLS
tls.ja3=tls.ja3

# SPI data settings
spiDataMaxIndices=4
CONF

echo ""
echo "=== Initialize Elasticsearch indices ==="
/opt/arkime/db/db.pl http://elastic:9200 init

echo ""
echo "=== Start Arkime services ==="
systemctl start arkimecapture
systemctl start arkimeviewer
systemctl enable arkimecapture
systemctl enable arkimeviewer

echo ""
echo "=== Check capture status ==="
/opt/arkime/bin/arkime-capture --status 2>/dev/null || true
systemctl status arkimecapture --no-pager

echo ""
echo "=== Add admin user ==="
/opt/arkime/bin/arkime_add_user.sh admin "Admin User" your_password --admin

echo ""
echo "=== Verify: open web UI at http://localhost:8005 ==="
curl -s -o /dev/null -w "%{http_code}" http://localhost:8005/

Mental model: Arkime = PCAP archive with a fast index, not a SIEM

Arkime's value proposition is specifically about making raw PCAP searchable and retrievable. It is not a SIEM replacement (it has no alert engine), not a real-time detection tool (Suricata does that), and not a structured log database (Zeek does that). What Arkime uniquely provides is: given any search criteria (IP, time range, protocol, content), retrieve the actual packets in seconds, regardless of how large your PCAP archive is. The architectural insight that makes this possible: Arkime stores the byte offset into the PCAP file for every session in Elasticsearch. When you search for sessions, Elasticsearch returns the matching session records instantly — including their file offsets. Arkime then reads those exact bytes from disk. The search doesn't scan the PCAP files; it only reads the specific bytes that belong to matching sessions. This is why Arkime's PCAP retrieval is fast even with multi-petabyte archives: the Elasticsearch query is the fast part, and the disk read only retrieves the bytes you actually need.

Q & A

Q: Arkime's Elasticsearch cluster is consuming 10 TB of disk for session metadata. How do I reduce it without losing PCAP?

The session metadata in Elasticsearch is a small fraction of the PCAP size (typically 0.5-2% of PCAP volume), but at petabyte scale it can be significant. Reduction strategies: (1) Reduce index retention separately from PCAP retention: in config.ini, sessionTimeout controls metadata retention. You can keep PCAP for 30 days but metadata only for 7 days — forensics investigators who need old metadata can extract it from PCAP using Zeek or tshark. (2) Disable verbose protocol fields: Arkime indexes many optional fields by default. Review which protocol analyzers you actually use in search queries, and disable the rest in config.ini (e.g., if you never search by HTTP cookie, disable cookie indexing). (3) Elasticsearch ILM: configure Index Lifecycle Management to move old indices from hot (SSD) to warm (HDD) storage after 7 days, and delete after the retention period. (4) Don't index traffic you don't investigate: use BPF filters in Arkime's config.ini to skip high-volume, low-value traffic (e.g., NTP, mDNS, DHCP) from being indexed — they bloat the metadata index without forensic value.