{"id":101602,"date":"2021-10-11T22:22:46","date_gmt":"2021-10-11T20:22:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dostupna-sistema-indeksaczii-setevogo-trafika-arkime-3-1"},"modified":"2021-10-11T22:22:46","modified_gmt":"2021-10-11T20:22:48","slug":"dostupna-sistema-indeksaczii-setevogo-trafika-arkime-3-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/dostupna-sistema-indeksaczii-setevogo-trafika-arkime-3-1","title":{"rendered":"The Arkime 3.1 network traffic indexing system is now available.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of the Arkime 3.1 network packet capture, storage, and indexing system has been prepared. It provides tools for visual assessment of traffic flows and searching for information related to network activity. Originally, the project was developed by AOL with the goal of creating an open, deployable alternative to commercial network packet processing platforms, capable of scaling to handle traffic at speeds of tens of gigabits per second. The traffic capture component is written in C, and the interface is implemented in Node.js\/JavaScript. Source code is distributed under the Apache 2.0 license. It supports operation in Linux and FreeBSD. Pre-packaged versions are available for Arch, CentOS, and Ubuntu. <\/p>\n
Arkime includes tools for capturing and indexing traffic in standard PCAP format and provides means for quick access to indexed data. The use of the PCAP format significantly simplifies integration with existing traffic analyzers such as Wireshark. The volume of stored data is limited only by the size of the disk array available. Metadata about sessions are indexed in a cluster based on the Elasticsearch engine. <\/p>\n
A web interface is provided for analyzing accumulated information, allowing for navigation, searching, and exporting samples. The web interface includes several viewing modes \u2014 from overall statistics, connection maps, and visual graphs showing changes in network activity to tools for examining individual sessions, analyzing activity based on used protocols, and parsing data from PCAP dumps. An API is also available, enabling the transfer of captured packet data in PCAP format and parsed sessions in JSON format to third-party applications.
<\/center> <\/p>\n
Arkime consists of three core components: <\/p>\n
\n
Traffic capture system \u2014 a multithreaded application in C for monitoring traffic, recording dumps in PCAP format to disk, parsing captured packets, and sending metadata about sessions (SPI, Stateful Packet Inspection) and protocols to an Elasticsearch cluster. PCAP files can be stored in encrypted form. <\/li>\n
![\"The](\"\/wp-content\/uploads\/2021\/10\/bb986bd37f5aeb4fea492cc0bf1b2eee.jpg\")
<\/center> <\/p>\n![\"The](\"\/wp-content\/uploads\/2021\/10\/3a9db1e8023aa55495d54a6bd9aad6cc.jpg\")
<\/center> <\/p>\n