Latest Commit 7

🚫 This is NOT the release you are looking for. move along. We are in the very early stages of Arkime 7 development, so use last-commit6 if you want something that actually works. Curious what's potentially coming? Try the 7 demo. 🚫

Latest Commit 6

Hi! After every commit to the main branch of Arkime 6 we build and store the results here. The builds are based on Arkime 6, so if upgrading from Arkime 5, make sure you've followed the upgrading to 6 instructions. If you don't want to run the pre release version, check out our stable release.

We need your help! Please support Arkime by becoming a Sponsor!

Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

Sanitize builds are used for detecting memory leaks and other issues, see Sanitizer Info

BTW, we have a baby CTF and our next in person Arkimeet mini conference is Oct 6, please join us!!!

v6.7.0

Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from Arkime 5 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

✨ What's new ✨

Release

• #4166 Node 22.23.2
• #4196 Cyberchef 11.3.0

All

• #4128 Add changePasswordSecret.js to re-encrypt all users' passwords and cont3xt keys after changing the passwordSecret
• #4134 Fix a cleared (null) user permission being treated as a denial instead of falling back to the roles' value
• #4183 Add !role search filter on the Users tab to list users that don't have a matching role
• #4194 Add Microsoft Teams notifier (uses Power Automate Workflows webhooks)
• #4202 Exit at startup when a header authMode has no userNameHeader instead of failing every request
• #4206 Fix changePasswordSecret.js sometimes accepting a wrong old passwordSecret for a user, re-encrypting their password from garbage instead of leaving them alone

Capture

• #4120 Fix offline pcap runs (-r/-R) loading the stopped-sessions state file
• #4121 Fix DNS HTTPS/SVCB records dropping a valid trailing zero-length SvcParam
• #4121 Fix diameter parser not unregistering when its reassembly buffer overflowed
• #4126 Add --sorted option to process offline pcap directories in alphabetical order
• #4143 Fix an over-long request URL (from a remote S3/SQS object key or IMDS role name) exiting capture instead of dropping the single request
• #4143 Fix SCTP in-order reassembly not bounding queued fragments, letting a stream of begin-without-end fragments grow memory unbounded
• #4143 Fix IPv4 fragment reassembly not recognizing the last fragment when it carried a DF or reserved flag bit, which could skip reassembly
• #4143 Fix the SQS reader holding a credentials pointer across its poll loop that could be freed after a credential refresh
• #4143 Fix a malformed or unreachable WISE server killing capture; WISE responses are now logged and skipped instead of exiting
• #4143 Fix a remote HTTP response's Content-Length pre-allocating up to 2GB; the response buffer now grows as data arrives
• #4149 Add 24 new magicMode=basic matches, including ELF, Mach-O, java class, wasm, OLE, lnk, 7z, zstd, sqlite and pcap
• #4149 Fix magicMode=basic returning audio/x-wav for every RIFF body, webp and avi are now identified correctly
• #4150 Add autoGenerateId=sequential, a lock free per thread session id generator that is much faster on session heavy traffic
• #4153 override-ips asn: values are now matched anchored, /^AS\d+ .+/; a value with anything before the AS number used to be accepted and silently recorded with AS number 0, and is now rejected
• #4153 Fix DTLS ja4 being computed over a truncated string when a ClientHello had many extensions or signature algorithms
• #4153 Fix TLS/DTLS ClientHello parsing desyncing when the cipher suites length was odd, which could hide the SNI and give a wrong ja3/ja4
• #4178 Add tcp.synValidated and tcp.synAckValidated fields recording whether each side of the TCP handshake was sequence-validated, and tcp.srcISNCnt counting distinct client ISNs seen (thanks @jeffreygolden)
• #4187 Fix crash when redefining the type of a builtin field via wise or custom-fields
• #4188 Add wiseRequestTimeout setting, default 30 seconds, so a stuck wiseService doesn't delay capture shutdown for minutes
• #4207 Fix pcap-over-IP counting a 65536 byte packet as corrupt instead of reporting it as too large
• #4207 Fix snapLen allowing 65536, one more than capture can represent, which recorded a max size packet as zero length
• #4207 Fix tunneled ethernet frames more than 2048 bytes into a packet recording the wrong src/dst MACs
• #4207 Fix the add-file and add-dir commands leaking memory, and possibly crashing, when given a bad --op
• #4207 Fix a memory leak writing pcap to S3 when the endpoint repeats an ETag header

Cont3xt/Viewer

• #4190 Cont3xt URLHaus and MalwareBazaar integrations now require an API key (free at https://auth.abuse.ch/)
• #4190 Fix Cont3xt URLHaus and MalwareBazaar rendering an empty card by adding their missing card fields (thanks @m-jingu)
• #4134 Add an MCP server at POST /mcp for viewer and cont3xt, off by default, enable with mcpEnabled.
• #4134 Add mcpUser role, required per user on top of the service role to use /mcp; superAdmin includes it, arkimeAdmin does not
• #4208 /mcp using a header auth mode now only allows localhost until mcpAllowedIps is set, the same as userAuthIps does for the rest of the site

db.pl

• #4127 Add reindex-sessions2 command to reindex sessions2 indices into sessions3, renaming flat fields to the ECS nested layout
• #4134 Add db.pl users-update command to bulk add/remove roles and set/unset fields on users matching a userId glob,
  eg db.pl host:port users-update '*' --addRole mcpUser --dryrun
• #4162 Add initorupgrade/initorupgradenoprompt command to init a fresh cluster or upgrade an existing one,
  whichever applies, pair with --ifneeded to no-op when already current
• #4208 Fix rm and mv acting on more than the named pcap file, a name with a wildcard or a space could remove the wrong files, and only the first 10 matches were ever handled
• #4208 Fix mv failing on pcap filenames that contain a quote or a backslash
• #4208 Fix expire deleting shrunk daily session indices a day early
• #4208 Fix expire --segments not also raising the --segmentsmin default, which force merged indices that didn't need it
• #4208 Fix import and restore reporting success when OpenSearch/Elasticsearch had rejected every document
• #4208 Fix restore ignoring the cont3xt indices that backup saves
• #4208 Fix add-missing and sync-files adding another node's files when a node name contains a '.', or exiting when it contains a '['
• #4208 Fix the es-adduser and es-passwd commands showing the password as it is typed
• #4208 Fix upgrade only checking the first 1000 capture nodes are stopped, and disable-users only looking at the first 1000 users

Cont3xt

• #4204 Fix cont3xt exiting when asked for an integration named after a built-in javascript property
• #4204 Fix cont3xt exiting on every link group fetch after invalid settings were saved; general and integration settings are now validated and report a real save failure
• #4204 Searching a single integration is now recorded in history, the same as a full search
• #4204 Add maxBulkIndicators, default 500, limiting how many indicators one search can query at once
• #4204 Fix history paging, sorting and search parameters not being validated for all database backends
• #4204 Fix an error while running a search exiting cont3xt instead of being logged

Viewer

• #4080 Add dbAdmin role that grants Elasticsearch/OpenSearch admin access; the esAdminUsers setting is now deprecated and will be removed in Arkime 7
• #4081 Let the dbAdmin role use the ES stats action menus (index, shard, and task operations); the ES indices menu now only requires removeEnabled for deleting an index, matching the backend
• #4120 Fix error responses crashing with an unhandled rejection when a session API handler passed an Error object to res.end
• #4120 Fix addTagsList/removeTagsList completion callback not being reliably called
• #4120 Hunts now fetch only the packet-related session fields instead of all fields, speeding up hunts on sessions with many fields
• #4134 Add mcpMaxQueryDays limiting how much time an MCP query may span, in days, default 7, -1 for no limit
• #4160 Add dbTimestamp field to search on when a session was written to the database (@ timestamp); session detail shows it after the stop time
• #4160 Fix date expression values ending in a timezone abbreviation (2026/07/27 09:33:05 UTC) generating an Invalid date ES query
• #4163 Add Packet Portal (experimental), a second viewer-to-viewer transport where a NAT'd sensor viewer dials out to a central viewer, which then sends its normal node-to-node requests (pcap, hunts, crons, proxying) back over that link; see packetPortal* settings
• #4172 Fix Download Entire PCAP failing on sensors behind esProxy; the rootId session search is now allowed through esProxy, and a failed search returns a 500 instead of an unhandled rejection
• #4203 Fix scrubbing pcap on a session held by a remote node exiting the viewer
• #4203 Fix a repeated query parameter (order, startTime, stopTime) never answering

WISE

• #4205 Fix intel files downloaded to /tmp being written through, or loaded from, a symlink or a file owned by another user
• #4205 Fix looked up values being able to inject into threatstream api requests, splunk searches, and redis key templates
• #4205 Fix threatstream sqlite3 mode failing on an itype name containing a quote
• #4205 Fix wiseService exiting on a valueactions or fieldactions file that has a section header in it
• #4205 Fix wiseService exiting on a csv url source whose rows are shorter than the key column
• #4205 Fix wiseService exiting on unexpected threatstream, threatq or alienvault data; a load that finds nothing now keeps the previous data
• #4205 Fix virustotal, opendns and passivetotal never looking a value up again when the service returned no result for it
• #4205 Fix isepxgrid returning nothing for the length of its session cache refresh
• #4205 Fix a phpipam url containing a quote breaking every right click action in viewer
• #4205 Fix the config UI erroring instead of rejecting a section named after a...

v6.6.0

Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from Arkime 5 or earlier

Support Arkime's ongoing development! Become a Sponsor!

✨ What's new ✨

Breaking

• #4072 WISE reversedns now returns resolved names that match none of the stripDomains entries in
  full (as documented) instead of silently dropping them
• #4073 The cont3xt Arkime integration searchDays setting now searches that many days instead of 7x that many.
  Existing configs that relied on the wider window must increase searchDays to keep the previous range.
• #4073 The cont3xt redis integration now substitutes 'domain' (not 'domainip') for %type% in keyTemplate on domain lookups.
  Deployments that stored domain data under the old 'domainip' key must re-key it as 'domain'.

Release

• #4066 Node 22.23.1
• #4056 Add Fedora 44 builds
• #4102 FreeBSD 14 builds use 14.4

All

• #4065 Fix OIDC login not preserving the redirect URL's query parameters (thanks @yanover)
• #4072 Fix header/OIDC auth requests hanging when a dynamic role update fails
• #4074 Harden user-auto-create/user-role-mappings expressions to run in strict mode
• #4079 Fix relative time +1M (month) and @M snapping being silently ignored; lowercase m still means minutes
• #4089 Consolidate header auth non-localhost host security warning across viewer/cont3xt/parliament/wiseService
• #4093 Fix page load failing with a 500 in OIDC mode when the issuer has no end_session_endpoint
• #4093 Fix user-role-mappings changes not taking effect until the next request; granted roles now apply and revoked roles stop working on the same request
• #4102 Fix concurrent requests during the first roles-cache population getting an undefined roles list
• #4102 Fix users CSV export header using comma-space separators while data rows use commas

Capture

• #4054 Fix GRE keepalive packets adding bogus 00:00:00:00:00:00 MACs
• #4055 Fix DNS memory leak when parsing malformed answers
• #4068 Add some missing http methods to parser
• #4074 Fix Geneve packets with protocol type 0 adding bogus 00:00:00:00:00:00 MACs
• #4074 Fix pcap-over-IP client reader not connecting to IPv6 endpoints
• #4078 Fix radiotap headers >= 256 bytes parsing at the wrong offset (it_len read as 8-bit instead of 16-bit)
• #4078 Fix Linux cooked (SLL) VLAN frames misdispatching non-IP payloads to IP and not recording the VLAN id
• #4078 Classify Control4 SDDP as sddp instead of mislabeling it ssdp
• #4079 Fix CAMEL recording the TCAP invokeID as a bogus operation code, and ENIP CIP class extraction failing on routed request paths with a port segment
• #4089 Fix netmap reader out-of-bounds ring index when netmapThreads doesn't evenly divide the interface's RX ring count
• #4089 Fix file reader silently stopping on EINTR instead of retrying
• #4089 Fix directory monitor leaking watch state when a watched directory is deleted
• #4090 Add new zeekintel plugin that can read Zeek intel framework files and tag/annotate sessions whose ips, hosts, urls, emails or hashes match a loaded indicator
• #4091 Fix ICMPv6 home-agent-reply (type 145) community-id not matching other tools or the reverse direction
• #4091 Fix IKEv2 parsing issues
• #4091 Fix MQTT parser PUBLISH issues
• #4091 Fix s3:// directory listing silently dropping pages after the first when the bucket needs continuation requests
• #4091 Rename misspelled protocol classifier stream-ihscp to steam-ihscp (Steam In-Home Streaming Control Protocol)
• #4093 Fix tagger and zeekintel plugins potentially cross-matching IPv4 and IPv6 entries whose leading bits coincide; IPv4 entries are now stored v4-mapped in the shared tree
• #4095 Fix python packet callbacks crashing capture when the callback returns a non-int (e.g. None)
• #4095 Fix s3:// reader dropping the X-Amz-Security-Token header with s3PathAccessStyle, breaking STS/IAM temporary credentials
• #4095 Fix pcap-over-IP treating nanosecond pcap timestamps as microseconds
• #4095 Fix tpacketv3 fanout ids overflowing into the fanout mode with multiple interfaces and a large tpacketv3ClusterId
• #4095 Fix ARKIME_ env vars whose value contains __ creating garbage config sections
• #4095 Fix lua plugin crashing at startup when luaFiles is present but empty
• #4095 Fix lua tcpflags.fin/tcpflags.urg session gets returning nil, and a Lua registry leak on every completed HttpService request
• #4097 Fix session-command processing throttle never engaging when the packet queue is 75% full
• #4097 Fix s3:// directory listing stopping early when a listing page contains no pcap files
• #4097 Fix ARP and NBNS session-detail IP clicks/exports building nonexistent ip.arp/ip.nbns expressions
• #4097 Fix cert:certificate-authority testing the cRLSign keyUsage bit instead of keyCertSign, and keyUsage being ignored when subjectAltName precedes it
• #4097 Fix HTTP CONNECT tunnels hashing server tunnel bytes into http.md5/sha256 and never releasing the http parser
• #4097 Fix RDP parser silently desyncing when the reassembly buffer overflows (now tagged rdp:frame-too-long)
• #4097 Fix S7comm reading fields from the next buffered TPKT frame when COTP/S7 lengths are bogus
• #4097 Fix SCTP reassembly corrupting messages when fragments of different streams interleave
• #4098 Fix M2UA Protocol Data 2 messages including the length-indicator octet in the MTP3 payload, corrupting decoded SS7 fields
• #4098 Fix MQTT parser desyncing on messages too large for the reassembly buffer (now tagged mqtt:message-too-long)
• #4098 Fix NBNS only parsing the first packet in each direction of a session
• #4098 Fix synchrophasor CFG-3 frames misparsing PMU names after the first (digital channel name count and PHSCALE size)
• #4098 Fix ospf.msgType exact searches failing because the field was declared lowercase but stores mixed-case values
• #4098 Fix tagger plugin not removing IPv4 ip entries when a tagger file is reloaded or removed
• #4098 Fix session detail issues: RADIUS missing Msg Type/NAS IPs/NAS Port fields, SIP User-Agent menus building a nonexistent sip.useragent expression, and cert JA4x_r row layout
• #4098 Fix lua sample smb.lua FSCTL and Find subcommand names never matching
• #4100 Fix draft-v6 M3UA Protocol Data (tags 2/3) being parsed with the RFC 4666 structured layout instead of as raw MTP3
• #4100 Fix M2UA/M3UA associations captured from the ASP handshake never being classified, and control messages unregistering the parser
• #4100 Fix SNMP recording a bogus GetResponse type for non-PDU content, and version-2u sessions being tagged snmp with no fields
• #4100 Fix SSH hassh being computed over bytes of the following record when a KEXINIT name-list length is corrupt
• #4100 Fix synchrophasor parser silently desyncing when the reassembly buffer overflows (now tagged synchrophasor:frame-too-long)
• #4100 Fix WebSocket text/close frames spanning TCP segments losing their sample/code/reason, and continuation frames after an interleaved Ping losing text samples
• #4100 Fix JA3/JA3S edge cases: truncated server extension header injected a fake extension into JA3S, and empty/all-GREASE extension or curve lists suppressed JA3 entirely
• #4100 Fix Modbus recording a bogus exception code from truncated exception frames, and mislabeling requests/responses when the server is the session initiator
• #4100 Fix modbus/dnp3/enip parsers silently desyncing when the reassembly buffer overflows (now tagged frame-too-long)
• #4100 Fix M2UA/M3UA associations carrying multiple service indicators (e.g. ISUP + SCCP) only parsing the first one
• #4100 Fix MQTT PUBLISH messages with topics too large to buffer being tagged mqtt:bad-publish instead of mqtt:message-too-long
• #4100 Fix Oracle TNS connect strings of 256 bytes or more never being classified
• #4100 Fix SIP over TCP not classifying sessions opening with OPTIONS, and PUBLISH requests not recording a method
• #4100 Fix padded RADIUS datagrams never being classified, and a malformed attribute dropping all attributes after it
• #4100 Fix netflow plugin exporting per-thread flow sequence numbers, which collectors saw as massive loss/duplication, and reject SNMP ifIndex settings over 65535 (16-bit on the wire)
• #4100 Fix wise plugin lookups too large for the request buffer being silently truncated off the wire request, and inflight counter races
• #4100 Fix kafka plugin only using the first bootstrap server of a semicolon-separated kafkaBootstrapServers list
• #4100 Fix writer-s3 building corrupt CompleteMultipartUpload requests after a failed part upload (now aborts the upload), leaking queued buffers forever when multipart init fails, and capture exiting when a periodic credential refresh fails
• #4100 Fix lua plugin HTTP MESSAGE_BEGIN callback only firing for the first message per direction on keep-alive connections
• #4104 Fix tagger plugin crashing when an ES poll hit has no _id, and a memory leak when a hit has no md5
• #4107 Fix python per-session parsers (register_parser/register_parser_buf) crashing capture when the callback is freed at session end without a Python thread state
• #4107 Fix pcap-over-IP server exiting when a client sends truncated or oversized packet records; now skips the packet or closes just that connection
• #4107 Fix http:// and https:// scheme reader dropping the URL query string (breaking pre-signed S3 style links) and silently ignoring...

v6.5.0

Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from Arkime 5 or earlier

Support Arkime's ongoing development! Become a Sponsor!

✨ What's new ✨

Breaking

• #4005 userAuthIps is now correctly matched against the real connecting peer address. Deployments behind a proxy must ensure the proxy's own address is covered by userAuthIps when authTrustProxy is used.

Release

• #4004 Fix Ubuntu 26.04 builds having the incorrect dependencies

All

• #4030 Fix hidePcap/hideFiles/hideStats/disablePcapDownload failing open for users with the permission inherited from multiple roles
• #4031 Fix CSV formula injection in session, connection, and user CSV exports by neutralizing cells starting with = + - @

Capture

• #3996 Added missing ntlm.detail.jade for NTLM session detail rendering
• #3996 Added opcua parser (OPC UA Binary) with opcua.endpointUrl, opcua.securityPolicyUri and SenderCertificate parsing
• #3997 Added IPFIX and sFlow v5 classifiers for flow telemetry visibility
• #3997 Added DCERPC interface labels for AD CS (MS-WCCE/ICPR), PrintNightmare (MS-RPRN/MS-PAR), DfsCoerce, ShadowCoerce, WMI, BackupKey (BKRP), EventLog6, DFS-R (FRS2), and IObjectExporter
• #3998 Identify AD CS web enrollment over HTTP (ESC8) as protocols adcs-web/adcs-ndes/adcs-cep/adcs-ces based on URL path
• #3998 Identify RPC-over-HTTP (Outlook Anywhere / RPC Proxy) as protocol rpc-over-http via RPC_IN_DATA/RPC_OUT_DATA verb classifiers
• #3998 Identify WinRM / WS-Management (PowerShell Remoting, evil-winrm, WEF) as protocol winrm via POST /wsman
• #3999 Add DCERPC labels (even, mapi, iwbemlevel1login, msrp, dnsserver) and fix IRemUnknown/IRemUnknown2/ISystemActivator/ioxidresolver mislabels
• #4008 Extract arp.ip / arp.mac / arp.oui / arp.opcode from ARP packets
• #4010 Fix crash on startup when rootPlugins is set
• #4013 Add entropy plugin to calculate the Shannon entropy of the TCP/UDP data bytes per direction, with entropyChunkSize and entropyMaxUniqueValues options
• #4015 Initial napatech reader implementation (thanks @waynieack)
• #4019 Fix TCP flow split into two sessions when a reordered original SYN (arriving after FIN/RST, e.g. across multiple capture interfaces/reader threads) was mistaken for a port reuse
• #4021 Fix hunts and PCAP retrieval stalling with the writer-s3 plugin when a session's file is missing
• #4023 Fix TLS parser dropping the server hello/certificate when the entire client direction was processed before the server's ServerHello
• #4024 Fix ESP sessions labeled with reverse direction
• #4024 Fix DNS/TLS templates
• #4024 Fix TCP/SCTP reassembly failure on U32 wrap in some cases
• #4024 Fix HTTP DELETE request Host/Cookie/Authorization headers being treated as response headers
• #4024 Fix SMTP Q-encoded header and AUTH decoding
• #4025 Fix HTTP request/response header mislabeling on reversed-direction sessions
• #4025 Fix S7comm function code 0x00 mislabeled as "Setup communication" (now "CPU services")
• #4025 Fix CAMEL/CAP operation code table to match 3GPP TS 29.078
• #4025 Fix DNS EDNS(0) extended RCODE (BADVERS..BADCOOKIE) not being decoded
• #4025 Fix TLS certificate enrichment crash when a cert has no extra fields
• #4025 Fix NetBIOS name decoding for embedded spaces, compressed names, and authority records
• #4026 Fix [packet-drop-ips] section in the main config file never being loaded (only packetDropIpsFiles worked)
• #4026 Fix IPv6 DSCP extraction using only the top 4 bits of the traffic class
• #4026 Fix rules file field modifier (contains/head/tail) on one field incorrectly applying to later fields in the same rule
• #4027 Fix wrong packetPos when reading truncated captures with readTruncatedPackets set
• #4030 Fix MQTT multi-topic UNSUBSCRIBE only extracting the first topic
• #4030 Fix SCTP reassembly losing messages after out-of-order delivery, causing spurious incomplete-sctp
• #4030 Fix SMB2 TREE_CONNECT share name not decoded for SMB2-only sessions
• #4030 Fix max-free-percent/max-free-bytes pcapDir selection lagging by one file

Cont3xt

• #3999 Fix logoutUrl when logoutUrlMethod=GET

Parliament

• #4028 Harden parliament against malicious Arkime clusters

Viewer

• #3994 Fix SPIView all not allowed error message
• #4007 Add sanitized {ORIGINALNAME} uploadCommand variable as a safe alternative to {INSECURE-ORIGINALNAME}
• #4018 Added support for preauth and postauth endpoint registration to plugins
• #4027 Fix viewer crash when /api/sessions/csv with ids fails to build the query
• #4027 Fix malformed TOTP codes causing a request error instead of being treated as invalid
• #4031 Fix potential stored XSS in session detail
• #4031 Fix stored XSS in hunt search string

Wise

• #3999 Mark phpipam appCode/password and fieldactions/valueactions url fields as secret so they are redacted in /config/get
• #3999 Add /api/user endpoint and hide save/import/create-source UI controls from non-wiseAdmin users

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2026.

v6.4.0

Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from Arkime 5 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

✨ What's new ✨

Breaking

• #3967 All header* auth modes (header, header-jwt, headerOnly, header+digest, header+basic) now default userAuthIps to localhost-only when not explicitly configured
• #3982 docker.sh: TLS verification is now enforced by default for Elasticsearch/OpenSearch connections, use --insecure to skip verification
• #3983 multies now defaults multiESHost to 127.0.0.1 instead of binding to all interfaces.

Release

• #3941 Move to using curl instead of wget everywhere and now depend on curl package
• #3975 Node 22.22.3

All

• #3951 Fix UTF-8 mojibake in user names auto-created via header auth (e.g. behind Caddy/oauth2-proxy)

Capture

• #3954 Add trimEthernetPadding option to strip Ethernet padding/FCS so saved pcap and byte counts match the on-wire IP length
• #3957 Even when not writing packets still save new sessions midway
• #3958 Add stateDir config option (default /tmp) for capture state files (drophash, stoppedsessions)
• #3958 State files now opened with O_NOFOLLOW to prevent symlink attacks
• #3958 PCAP files now opened with O_NOFOLLOW to prevent symlink attacks
• #3962 Improved websocket parser; adds websocket.* fields and websocketTextSampleCnt config option
• #3963 Improved mDNS parsing: handle aggregated queries, unsolicited responses, and flags
• DNS TXT records now capture multiple items
• #3965 Add diameter.resultCode field (AVP 268) for 4G/5G core auth/error tracking
• #3965 Add dnp3.funcName and s7comm.funcName decoded ICS function-code names
• #3965 Add mqtt.connackCode for CONNACK return/reason codes
• #3965 Add snmp.engineId and snmp.secLevel SNMPv3 fields
• #3966 Add enip parser
• #3969 Include up to 12 bytes of UDP payload in the packet dedup hash so RTP and other UDP traffic with identical headers is no longer over-deduplicated
• #3970 Added full OpenVPN classifier/parser
• #3972 Improved STUN/TURN parser: extract XOR-PEER-ADDRESS, more methods, and stun.attributes field
• #3973 Improved OSPF parser: per-(src,dst) sessions and ospf.msgType/routerId/areaId fields, tag weak auth
• #3977 Improved RADIUS parser: extract radius.msgType, radius.nasIp, and radius.nasPort
• #3978 New FTP parser: detect multi-line 220- banners and add ftp.banner, ftp.command, ftp.filename, ftp.responseCode fields; tag ftp:password when PASS is seen
• #3985 Add shared NTLMSSP decoder with ntlm.* fields, wired into SMB, HTTP, LDAP, DCE-RPC, SMTP, IMAP, POP3, and TDS parsers
• #3985 Add new POP3 parser that captures USER name and NTLM auth blobs
• #3988 Fix command-socket --notify without --flush crashing capture
• #3988 Fix crash when using rules with bpfs and different DLTs without using --flush

Multies

• #3983 Support optional HTTP Basic auth via the new multiESBasicAuth setting

WISE

• #3968 Improve JSON Array Parsing: shortcut paths now expand arrays at any intermediate position, not just the final value

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2026.

v6.3.1

Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from Arkime 5 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

✨ What's new 6.3.1 ✨

Capture

• #3940 Fix ISAKMP parser on UDP/4500 (NAT-T) misparsed ESP packets without the non-ESP marker

Viewer

• #3942 Fix hiding packets when we shouldn't

✨ What's new 6.3.0 ✨

BREAKING

• #3911 ArkimeParserBuf_t.buf is now a heap-allocated pointer (uint8_t *buf[2]). You must use pb->bufSize[which] instead of sizeof(pb->buf[which])

All

• #3920 Log more information on role failures

Capture

• #3910 Corrupt UDP packets could have invalid byte counts
• #3910 TCP DNS packets might not be parsed correctly depending on segmentation
• #3911, #3913 TCP sequence wrapping tests and improvements
• #3912 Fix IKEv2 encryption/hash parsing
• #3913 Fix WISE plugin skipping fields after array-typed fields
• #3913 Fix S3 listing deadlock when bucket/prefix is empty
• #3914 Fix ASN.1 OID decoding of first arc per X.690
• #3916 Improved NTP and IS-IS parsing
• #3917 Improved LUA ip handling
• #3917 Add DHCPv6 relay parsing
• #3917 Improved SMB parsing of share/filename
• #3917 Improved SNMP GetBulkRequest parsing
• #3917 Extract VNI from GENEVE tunnels
• #3918 scheme http no longer requires a port (defaults to 80/443)
• #3918 fix SNMP sessions showing up as LDAP too
• #3919 Remove ftp protocol if we are sure smtp
• #3923 Packets with more than 8 VLANs marked as corrupt
• #3923 UDP packets enforce length correctly
• #3924, #3930 Remove trailing slash from wiseURL
• #3927 Cap IMAP/SMTP/HTTP Header buffer lengths
• #3932 Skip byte-based UDP classifiers on UDP/53 to avoid DNS false-matches
• #3933 Reassemble TLS ClientHello across multiple QUIC Initial packets
• #3935 Validate QUIC packet lengths

Cont3xt

• #3928 Threatstream: ignore per-user host override unless user/key also per-user
• #3928 csvjson: add 60s timeout and 1GB content/body limits on remote feed loads

Viewer

• #3898 show error msg in spiview when All selected but not allowed
• #3906 add copy button to History Elasticsearch Query section
• #3908 fix download entire pcap missing filename
• #3921 Fix Cap Restart graph markers, Session Detail labels slider width, Field Actions dropdown, Stats Shrink Index, and shortcut ($) autocomplete in search expression
• #3928 Cap /api/sessions/summary length parameter at 1000
• #3931 Remove last manualQuery option which wasn't implemented
• #3934 Fix not handling sessions correctly with no PCAP

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2026. The EL 8 builds will stop in May 2026, please upgrade.

v6.3.0

This build is broken use 6.3.1 instead.

✨ What's new ✨

BREAKING

• #3911 ArkimeParserBuf_t.buf is now a heap-allocated pointer (uint8_t *buf[2]). You must use pb->bufSize[which] instead of sizeof(pb->buf[which])

All

• #3920 Log more information on role failures

Capture

• #3910 Corrupt UDP packets could have invalid byte counts
• #3910 TCP DNS packets might not be parsed correctly depending on segmentation
• #3911, #3913 TCP sequence wrapping tests and improvements
• #3912 Fix IKEv2 encryption/hash parsing
• #3913 Fix WISE plugin skipping fields after array-typed fields
• #3913 Fix S3 listing deadlock when bucket/prefix is empty
• #3914 Fix ASN.1 OID decoding of first arc per X.690
• #3916 Improved NTP and IS-IS parsing
• #3917 Improved LUA ip handling
• #3917 Add DHCPv6 relay parsing
• #3917 Improved SMB parsing of share/filename
• #3917 Improved SNMP GetBulkRequest parsing
• #3917 Extract VNI from GENEVE tunnels
• #3918 scheme http no longer requires a port (defaults to 80/443)
• #3918 fix SNMP sessions showing up as LDAP too
• #3919 Remove ftp protocol if we are sure smtp
• #3923 Packets with more than 8 VLANs marked as corrupt
• #3923 UDP packets enforce length correctly
• #3924, #3930 Remove trailing slash from wiseURL
• #3927 Cap IMAP/SMTP/HTTP Header buffer lengths
• #3932 Skip byte-based UDP classifiers on UDP/53 to avoid DNS false-matches
• #3933 Reassemble TLS ClientHello across multiple QUIC Initial packets
• #3935 Validate QUIC packet lengths

Cont3xt

• #3928 Threatstream: ignore per-user host override unless user/key also per-user
• #3928 csvjson: add 60s timeout and 1GB content/body limits on remote feed loads

Viewer

• #3898 show error msg in spiview when All selected but not allowed
• #3906 add copy button to History Elasticsearch Query section
• #3908 fix download entire pcap missing filename
• #3921 Fix Cap Restart graph markers, Session Detail labels slider width, Field Actions dropdown, Stats Shrink Index, and shortcut ($) autocomplete in search expression
• #3928 Cap /api/sessions/summary length parameter at 1000
• #3931 Remove last manualQuery option which wasn't implemented
• #3934 Fix not handling sessions correctly with no PCAP

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2026. The EL 8 builds will stop in May 2026, please upgrade.

v6.2.0

Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from Arkime 5 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

✨ What's new ✨

BREAKING

• #3874 The user-auto-create and user-role-mappings sections now limit what
  loop and exception Javascript can be used for security.
• #3881 Command sockets now chmod(0660) and removes Other access.

Release

• #3864 CyberChef 10.23.0
• #3870 docker.sh supports generic --db with help examples

All

• #3831 New TOTP support for wise config instead of code - requires db.pl upgrade
• #3865 Add syslog notifier
• #3866 Add snmp notifier
• #3888 Can now use - for password with addUser.js to get prompted

Capture

• #3871 Packets with more than 10 ip/ethernet headers are now marked as corrupt
• #3896 Improve MQTT parsing and tests

Capture/Viewer

• #3833 New simpleDEKEncoding setting which controls how the DEK is encrypted
• #3857 Fix scheme pcapNG not handling large files (thanks @wegman12)

db.pl

• #3860 Add --compression option

Viewer

• #3842 Add internationalized aria-labels
• #3863 Add per-cluster serverSecret in S2S auth for multicluster pcap retrieval
• #3878 Add JWT decoding support for header auth mode
• #3877 Add ESIndices codec column
• #3891 Improve tcp reassembly display when packets are retransmitted

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2026. The EL 8 builds will stop in April 2026, please upgrade.

v6.1.1

Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from Arkime 5 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

✨ What's new ✨

BREAKING

• #3812 The user-auto-create and user-role-mappings sections now limit what Javascript can be used for security.

Release

• #3834 Node 22.22.2

All

• #3812 Validate javascript expression in user-auto-create and user-role-mappings
• #3835 Fix reverse proxy being unhappy with no params after a ? in urls

Capture

• #3813 Add ECE, CWR, and AE TCP flag support
• #3818 Improve scheduling http requests with libcurl (thanks @swannman)
• #3829 Add ADB (Android Debug Bridge) parser (thanks @h0wdee)
• #3836 Fix bacnet false positives on dns ports
• #3843 Improve JSON encoding of UTF8 strings
• #3841 command socket add-file/dir now supports notify on complete (--notify) and new file-status command (thanks @wegman12)
• #3847 Fix crash when parsing malformed packets
• #3855 Fix --copy not working in command socket mode (thanks @wegman12)

Multies

• #3830 Show cluster when using multies

Viewer

• #3826 Handle ip frag pcap display better

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2026. The EL 8 builds will stop in April 2026, please upgrade.