The release of the Arkime 3.1 network packet capture, storage, and indexing system has been prepared. It provides tools for visual assessment of traffic flows and searching for information related to network activity. Originally, the project was developed by AOL with the goal of creating an open, deployable alternative to commercial network packet processing platforms, capable of scaling to handle traffic at speeds of tens of gigabits per second. The traffic capture component is written in C, and the interface is implemented in Node.js/JavaScript. Source code is distributed under the Apache 2.0 license. It supports operation in Linux and FreeBSD. Pre-packaged versions are available for Arch, CentOS, and Ubuntu.
Arkime includes tools for capturing and indexing traffic in standard PCAP format and provides means for quick access to indexed data. The use of the PCAP format significantly simplifies integration with existing traffic analyzers such as Wireshark. The volume of stored data is limited only by the size of the disk array available. Metadata about sessions are indexed in a cluster based on the Elasticsearch engine.
A web interface is provided for analyzing the accumulated information, allowing navigation, searching, and exporting samples. The web interface offers several viewing modes—from overall statistics, connection maps, and visual graphs showing changes in network activity to tools for studying individual sessions, analyzing activity by used protocols, and parsing data from PCAP dumps. An API is also provided, enabling the transfer of captured packet data in PCAP format and parsed sessions in JSON format to third-party applications.
Arkime consists of three core components:
- The traffic capture system is a multithreaded application in C for traffic monitoring, recording dumps in PCAP format to disk, parsing captured packets, and sending metadata about sessions (SPI, Stateful Packet Inspection) and protocols to the Elasticsearch cluster. PCAP files can be stored in encrypted form.
- A web interface based on the Node.js platform, which runs on each server traffic capture node and handles requests related to accessing indexed data and transferring PCAP files via the API.
- Metadata storage based on Elasticsearch.
In the new release:
- Support for IETF QUIC, GENEVE, and VXLAN-GPE protocols has been added.
- Support for Q-in-Q (Double VLAN) type, allowing the encapsulation of VLAN tags within second-level tags to expand the number of VLANs to 16 million, has been added.
- Support for float field types has been added.
- The Amazon Elastic Compute Cloud recording module has been transitioned to use the IMDSv2 (Instance Metadata Service) protocol.
- Code refactoring has been conducted to add UDP tunnels.
- Support for elasticsearchAPIKey and elasticsearchBasicAuth has been added.
Source: opennet.ru
