Arkime

Filter Arkime’s Sessions page by time and search expression, open a session for details, then pivot on a field or export the matching results as PCAP or CSV. Session metadata is indexed in OpenSearch or Elasticsearch, while packet storage is a separate choice. Arkime can run with metadata only, retain selected traffic through rules, or save full PCAP. That means searchable session history does not guarantee the original packets are still available. Plan disk capacity, storage rules and retention for the investigation window you need. The open-source platform observes traffic reaching its capture deployment; its advertised scale does not establish capacity on an untested installation.