It’s 2:47 AM. Your SIEM fires an alert — unusual outbound traffic from a production database server. You SSH in, check netstat, see nothing obvious. The connection is already gone. Without packet-level data, you’re flying blind.
This exact scenario is why I now run Arkime on every network segment that matters. After my server got hit by SSH brute-force attacks at midnight, security moves to the top of every setup checklist — and “initial setup” now means full packet capture, not just firewall logs.
Logs tell you what happened. Packets tell you exactly how.
Approach Comparison: Your Options for Full Packet Capture
tcpdump + Rotating pcap Files
The go-to for quick captures. Simple, available everywhere, no dependencies.
tcpdump -i eth0 -w /pcap/capture-%Y%m%d%H%M%S.pcap -G 3600 -z gzipWorks fine until an incident surfaces three days later and you’re manually grepping through 200GB of gzipped pcaps at 3 AM. No indexing. No session view. Just you and a lot of compressed files.
Wireshark / tshark (Headless)
tshark can run headless for persistent capture, but Wireshark is fundamentally a GUI analysis tool. No indexing, no REST API, no web interface for team access. Not designed for long-term retention at scale.
Zeek (formerly Bro)
Zeek extracts rich metadata — connection logs, DNS, HTTP, TLS, file hashes — at very low overhead. The logs feed directly into SIEMs, which is exactly why security teams love it. But when an analyst asks “show me the exact bytes of that C2 beacon,” Zeek goes silent. It discards the payload. No session reconstruction, no pcap export.
Arkime (formerly Moloch)
Arkime captures everything — raw packets stored in indexed format, searchable through a web UI that lets you download pcap slices on demand. It pairs full pcap retention with metadata indexing via OpenSearch or Elasticsearch. Large enterprise SOCs and government network defenders use it for exactly this reason.
Pros and Cons
tcpdump / Raw pcap
- Pros: Zero setup time, works on any Linux box, ideal for short targeted captures
- Cons: No search capability at scale, manual correlation across files, no session reconstruction
Zeek
- Pros: Extremely lightweight, rich protocol dissection, structured logs ready for SIEM ingestion
- Cons: No payload storage, can’t reconstruct sessions for forensics, needs companion tools for deep packet analysis
Arkime
- Pros: Full packet storage with indexed metadata, web UI with powerful query language, TCP session reconstruction, REST API for automation, actively deployed in large government and enterprise SOC environments
- Cons: Heavy resource requirements (OpenSearch backend), setup complexity, significant storage cost — full pcap at 1Gbps runs roughly 450GB/hour
The tradeoff is clear: if you need to reconstruct exactly what an attacker did at the packet level, Arkime is the only option in this list that actually delivers.
Recommended Setup
For a home lab or small SOC environment:
- Capture server: 4 cores, 16GB RAM, 2TB+ storage (spinning disk is fine for pcap)
- OpenSearch 2.x on the same host for labs, or a separate cluster for production
- Arkime 5.x — current stable release
- Network tap or SPAN port feeding traffic to the capture interface
Monitoring a 1Gbps production link changes the math considerably:
- Capture server: 8+ cores, 32GB RAM, dedicated capture NIC with no IP address
- OpenSearch cluster: 3 nodes × 8GB heap
- Storage: 10TB+ with retention policies (typically 7–30 days depending on budget)
My own setup is a stripped-down version — an old i7 workstation with 16GB RAM capturing my homelab VLAN. It’s caught two instances of compromised IoT devices beaconing outbound that my firewall logs would have missed entirely.
Implementation Guide
Step 1: Install OpenSearch
Arkime needs OpenSearch (or Elasticsearch 7.x) as its metadata store. On Ubuntu/Debian:
wget -qO - https://artifacts.opensearch.org/publickeys/opensearch.pgp | \
sudo gpg --dearmor -o /usr/share/keyrings/opensearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring.gpg] \
https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main" | \
sudo tee /etc/apt/sources.list.d/opensearch-2.x.list
sudo apt update && sudo apt install opensearch -yConfigure JVM heap — set to half your available RAM, and never exceed 31GB:
sudo nano /etc/opensearch/jvm.options
# Set both lines:
-Xms8g
-Xmx8gsudo systemctl enable --now opensearch
# Verify it's up:
curl -s http://localhost:9200/_cluster/health | python3 -m json.toolStep 2: Install Arkime
# Check https://arkime.com/downloads for the latest version
wget https://github.com/arkime/arkime/releases/download/v5.3.0/arkime_5.3.0-1_amd64.deb
sudo dpkg -i arkime_5.3.0-1_amd64.debStep 3: Run the Configurator
sudo /opt/arkime/bin/ConfigureThe interactive configurator asks which interfaces to capture on, your OpenSearch URL, and an admin password. It generates /opt/arkime/etc/config.ini. Key settings to tune manually afterward:
[default]
elasticsearch=http://localhost:9200
interface=eth1
pcapDir=/data/arkime/pcap
maxFileSizeG=12
maxFileTimeM=60
freeSpaceG=5%
# Tune based on your link speed:
pcapWriteMethod=simple
pcapWriteSize=2560Set interface to your capture interface — the one connected to the SPAN port or network tap, not your management NIC.
Step 4: Initialize the Database and Start Services
sudo /opt/arkime/db/db.pl http://localhost:9200 init
# Create admin user
sudo /opt/arkime/bin/arkime_add_user.sh admin "Admin User" YOUR_STRONG_PASSWORD --admin
# Start capture and viewer
sudo systemctl enable --now arkimecapture
sudo systemctl enable --now arkimeviewerHit http://your-server:8005 in a browser. Within a minute, sessions start populating in the Sessions tab.
Step 5: Configure Index Retention
Skip retention policies and OpenSearch will eat your disk within days. This ISM policy auto-deletes indices older than 30 days:
curl -X PUT "http://localhost:9200/_plugins/_ism/policies/arkime-retention" \
-H 'Content-Type: application/json' -d '{
"policy": {
"description": "Delete arkime indices older than 30 days",
"default_state": "hot",
"states": [{
"name": "hot",
"actions": [],
"transitions": [{
"state_name": "delete",
"conditions": { "min_index_age": "30d" }
}]
}, {
"name": "delete",
"actions": [{ "delete": {} }],
"transitions": []
}]
}
}'Searching Traffic During an Incident
Arkime’s query language is what makes the whole setup worthwhile. In the Sessions view:
# Find all traffic to a suspicious IP
ip.dst == 185.220.101.45
# DNS queries matching a malicious domain pattern
dns.host == /.*evil-c2\.com/
# Large outbound transfers — potential data exfiltration
ip.dst != 10.0.0.0/8 && databytes > 10000000
# Combine: suspicious IP + specific port + time window
ip.dst == 185.220.101.45 && port.dst == 4444 && starttime >= 2024-01-15T02:00Right-click any session → Download PCAP to pull the raw packets into Wireshark. The built-in packet viewer can also reconstruct the TCP stream right in the browser — no local tools needed. Share your screen with the IR team and walk through the session together without anyone needing to install anything.
Lock Down the UI
Arkime’s web interface should never face the public internet. Non-negotiable:
# Allow only your management VLAN to reach the Arkime UI
sudo ufw allow from 10.0.1.0/24 to any port 8005
sudo ufw deny 8005
# The capture interface should have NO IP address
# Promiscuous mode with no attack surface:
ip link set eth1 promisc on
ip link set eth1 up
# Do NOT assign an IP to eth1For team access, put Arkime behind a WireGuard VPN or an nginx reverse proxy with mutual TLS. Never port-forward 8005 to the internet.
Full packet capture isn’t cheap — hardware, storage, and setup time all add up. But when you’re staring at a breach at 2 AM, you need answers fast. With Arkime already running, tracing exactly what left your network takes hours instead of days. That tradeoff has justified the cost every single time.
