Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install
A db.pl upgrade is required when upgrading from Arkime 5 or earlier
Support Arkime's ongoing development! Become a GitHub Sponsor!
✨ What's new ✨
Release
All
- #4128 Add changePasswordSecret.js to re-encrypt all users' passwords and cont3xt keys after changing the passwordSecret
- #4134 Fix a cleared (null) user permission being treated as a denial instead of falling back to the roles' value
- #4183 Add !role search filter on the Users tab to list users that don't have a matching role
- #4194 Add Microsoft Teams notifier (uses Power Automate Workflows webhooks)
- #4202 Exit at startup when a header authMode has no userNameHeader instead of failing every request
- #4206 Fix changePasswordSecret.js sometimes accepting a wrong old passwordSecret for a user, re-encrypting their password from garbage instead of leaving them alone
Capture
- #4120 Fix offline pcap runs (-r/-R) loading the stopped-sessions state file
- #4121 Fix DNS HTTPS/SVCB records dropping a valid trailing zero-length SvcParam
- #4121 Fix diameter parser not unregistering when its reassembly buffer overflowed
- #4126 Add --sorted option to process offline pcap directories in alphabetical order
- #4143 Fix an over-long request URL (from a remote S3/SQS object key or IMDS role name) exiting capture instead of dropping the single request
- #4143 Fix SCTP in-order reassembly not bounding queued fragments, letting a stream of begin-without-end fragments grow memory unbounded
- #4143 Fix IPv4 fragment reassembly not recognizing the last fragment when it carried a DF or reserved flag bit, which could skip reassembly
- #4143 Fix the SQS reader holding a credentials pointer across its poll loop that could be freed after a credential refresh
- #4143 Fix a malformed or unreachable WISE server killing capture; WISE responses are now logged and skipped instead of exiting
- #4143 Fix a remote HTTP response's Content-Length pre-allocating up to 2GB; the response buffer now grows as data arrives
- #4149 Add 24 new magicMode=basic matches, including ELF, Mach-O, java class, wasm, OLE, lnk, 7z, zstd, sqlite and pcap
- #4149 Fix magicMode=basic returning audio/x-wav for every RIFF body, webp and avi are now identified correctly
- #4150 Add autoGenerateId=sequential, a lock free per thread session id generator that is much faster on session heavy traffic
- #4153 override-ips asn: values are now matched anchored, /^AS\d+ .+/; a value with anything before the AS number used to be accepted and silently recorded with AS number 0, and is now rejected
- #4153 Fix DTLS ja4 being computed over a truncated string when a ClientHello had many extensions or signature algorithms
- #4153 Fix TLS/DTLS ClientHello parsing desyncing when the cipher suites length was odd, which could hide the SNI and give a wrong ja3/ja4
- #4178 Add tcp.synValidated and tcp.synAckValidated fields recording whether each side of the TCP handshake was sequence-validated, and tcp.srcISNCnt counting distinct client ISNs seen (thanks @jeffreygolden)
- #4187 Fix crash when redefining the type of a builtin field via wise or custom-fields
- #4188 Add wiseRequestTimeout setting, default 30 seconds, so a stuck wiseService doesn't delay capture shutdown for minutes
- #4207 Fix pcap-over-IP counting a 65536 byte packet as corrupt instead of reporting it as too large
- #4207 Fix snapLen allowing 65536, one more than capture can represent, which recorded a max size packet as zero length
- #4207 Fix tunneled ethernet frames more than 2048 bytes into a packet recording the wrong src/dst MACs
- #4207 Fix the add-file and add-dir commands leaking memory, and possibly crashing, when given a bad --op
- #4207 Fix a memory leak writing pcap to S3 when the endpoint repeats an ETag header
Cont3xt/Viewer
- #4190 Cont3xt URLHaus and MalwareBazaar integrations now require an API key (free at https://auth.abuse.ch/)
- #4190 Fix Cont3xt URLHaus and MalwareBazaar rendering an empty card by adding their missing card fields (thanks @m-jingu)
- #4134 Add an MCP server at POST /mcp for viewer and cont3xt, off by default, enable with mcpEnabled.
- #4134 Add mcpUser role, required per user on top of the service role to use /mcp; superAdmin includes it, arkimeAdmin does not
- #4208 /mcp using a header auth mode now only allows localhost until mcpAllowedIps is set, the same as userAuthIps does for the rest of the site
db.pl
- #4127 Add reindex-sessions2 command to reindex sessions2 indices into sessions3, renaming flat fields to the ECS nested layout
- #4134 Add db.pl users-update command to bulk add/remove roles and set/unset fields on users matching a userId glob,
eg db.pl host:port users-update '*' --addRole mcpUser --dryrun - #4162 Add initorupgrade/initorupgradenoprompt command to init a fresh cluster or upgrade an existing one,
whichever applies, pair with --ifneeded to no-op when already current - #4208 Fix rm and mv acting on more than the named pcap file, a name with a wildcard or a space could remove the wrong files, and only the first 10 matches were ever handled
- #4208 Fix mv failing on pcap filenames that contain a quote or a backslash
- #4208 Fix expire deleting shrunk daily session indices a day early
- #4208 Fix expire --segments not also raising the --segmentsmin default, which force merged indices that didn't need it
- #4208 Fix import and restore reporting success when OpenSearch/Elasticsearch had rejected every document
- #4208 Fix restore ignoring the cont3xt indices that backup saves
- #4208 Fix add-missing and sync-files adding another node's files when a node name contains a '.', or exiting when it contains a '['
- #4208 Fix the es-adduser and es-passwd commands showing the password as it is typed
- #4208 Fix upgrade only checking the first 1000 capture nodes are stopped, and disable-users only looking at the first 1000 users
Cont3xt
- #4204 Fix cont3xt exiting when asked for an integration named after a built-in javascript property
- #4204 Fix cont3xt exiting on every link group fetch after invalid settings were saved; general and integration settings are now validated and report a real save failure
- #4204 Searching a single integration is now recorded in history, the same as a full search
- #4204 Add maxBulkIndicators, default 500, limiting how many indicators one search can query at once
- #4204 Fix history paging, sorting and search parameters not being validated for all database backends
- #4204 Fix an error while running a search exiting cont3xt instead of being logged
Viewer
- #4080 Add dbAdmin role that grants Elasticsearch/OpenSearch admin access; the esAdminUsers setting is now deprecated and will be removed in Arkime 7
- #4081 Let the dbAdmin role use the ES stats action menus (index, shard, and task operations); the ES indices menu now only requires removeEnabled for deleting an index, matching the backend
- #4120 Fix error responses crashing with an unhandled rejection when a session API handler passed an Error object to res.end
- #4120 Fix addTagsList/removeTagsList completion callback not being reliably called
- #4120 Hunts now fetch only the packet-related session fields instead of all fields, speeding up hunts on sessions with many fields
- #4134 Add mcpMaxQueryDays limiting how much time an MCP query may span, in days, default 7, -1 for no limit
- #4160 Add dbTimestamp field to search on when a session was written to the database (@ timestamp); session detail shows it after the stop time
- #4160 Fix date expression values ending in a timezone abbreviation (2026/07/27 09:33:05 UTC) generating an Invalid date ES query
- #4163 Add Packet Portal (experimental), a second viewer-to-viewer transport where a NAT'd sensor viewer dials out to a central viewer, which then sends its normal node-to-node requests (pcap, hunts, crons, proxying) back over that link; see packetPortal* settings
- #4172 Fix Download Entire PCAP failing on sensors behind esProxy; the rootId session search is now allowed through esProxy, and a failed search returns a 500 instead of an unhandled rejection
- #4203 Fix scrubbing pcap on a session held by a remote node exiting the viewer
- #4203 Fix a repeated query parameter (order, startTime, stopTime) never answering
WISE
- #4205 Fix intel files downloaded to /tmp being written through, or loaded from, a symlink or a file owned by another user
- #4205 Fix looked up values being able to inject into threatstream api requests, splunk searches, and redis key templates
- #4205 Fix threatstream sqlite3 mode failing on an itype name containing a quote
- #4205 Fix wiseService exiting on a valueactions or fieldactions file that has a section header in it
- #4205 Fix wiseService exiting on a csv url source whose rows are shorter than the key column
- #4205 Fix wiseService exiting on unexpected threatstream, threatq or alienvault data; a load that finds nothing now keeps the previous data
- #4205 Fix virustotal, opendns and passivetotal never looking a value up again when the service returned no result for it
- #4205 Fix isepxgrid returning nothing for the length of its session cache refresh
- #4205 Fix a phpipam url containing a quote breaking every right click action in viewer
- #4205 Fix the config UI erroring instead of rejecting a section named after a javascript property
⬇️ Download Info ⬇️
We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2026. The EL 8 builds will stop for Arkime 7.
Contributors
m-jingu and jeffreygolden