Arkime 6 has NOT been released yet, not recommend for production yet

Hi! After every commit to the main branch of Arkime 6 we build and store the results here. These builds are based on Arkime 6, so if upgrading from Arkime 5, make sure you've followed the upgrading to 6 instructions. If you don't want to run the pre release version, check out our stable release.

We need your help! Please support Arkime by becoming a Github Sponsor!

Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

Sanitize builds are used for detecting memory leaks and other issues, see Sanitizer Info

Installation Instructions | 4.x -> 5.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from 5.1.2 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

✨ What's new ✨

Release

• #3510 Node 20.19.6

Capture

• #3489 Do a better job URL encoding the file exists check for managed OpenSearch

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2025.

Arkime 5 is no longer being updated. Please see last-commit6 for Arkime 6 commits.

Hi! After every commit to the main branch of Arkime 5 we build and store the results here. The builds are based on Arkime 5, so if upgrading from Arkime 4, make sure you've followed the upgrading to 5 instructions. If you don't want to run the pre release version, check out our stable release.

We need your help! Please support Arkime by becoming a Github Sponsor!

Installation Instructions | 4.x -> 5.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

Sanitize builds are used for detecting memory leaks and other issues, see Sanitizer Info

Installation Instructions | 4.x -> 5.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from 5.1.2 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

✨ What's new ✨

Release

• #3425 docker.sh add --add-admin option

Capture

• #3414 Support tls client hello packets that are split

Capture/Viewer

• #3408 ja4d6 support

Viewer

• #3412 Files tab can paginate over 10k entries now

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2025.

Installation Instructions | 4.x -> 5.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from 5.1.2 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

✨ What's new ✨

Release

• #3367 fix Configure not setting elasticsearchBasicAuth correctly
• New version of ja4d

Capture

• #3363 Fix lua session.dstIp
• #3368 Fix rules reload crash
• #3401 Fix dead lock if using s3 writer and s3 scheme reader

Viewer

• #3385 Fix missing pcap file header crash
• #3398 Fix leaving 10 oldest files since 5.4.0
• #3398 Log expire delete errors

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2025.

Installation Instructions | 4.x -> 5.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from 5.1.2 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

✨ What's new ✨

Release

• #3287 Node 20.19.4

All

• #3352 Abort and useful error for bad userAuthIps setting

Capture/Viewer

• #3307 Added garland timestamp plugin

Capture

• #3294 Improved dhcpv6 parser and ja4d display
• #3297, #3321 Fix lua memory leaks
• #3298 Fix dns encoding issues with answers
• #3299 Handle more than 255 ciphers with ja4
• #3305, #3337 added basic ip AH protocol support
• #3314 fix SQS/S3 with MinIO (thanks @mcgillowen)

db.pl

• #3320 Fixed some Elasticsearch/Opensearch calls that still had types
• #3323, #3328 New db.pl repair implementation that can fix multiple issues

Viewer

• #3319 Fix export csv from SPI Graph
• #3344 Fix parsing quoted arrays in wildcards
• #3358 Fixed files created with s3 capture scheme not showing in viewer
  if not in top level directory

WISE

• #3339 Elasticsearch source can have paths value shortcuts
• #3359 Elasticsearch source can have integer and object values

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2025.

Installation Instructions | 4.x -> 5.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from 5.1.2 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

✨ What's new ✨

All

• #3259 Config stored in Elasticsearch/OpenSearch now respects --insecure
• #3279, #3274, #3273 NPM dependabot fixes

Capture/Viewer

• #3258 Add new ethertype field

Capture

• #3258 unkEthernet plugin now groups sessions by ethertype + macs
• #3276 fix wise lookups for some hashed string fields

Cont3xt

• #3253 IPQualityScore support (thanks @RamboV)

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2025.

Installation Instructions | 4.x -> 5.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from 5.1.2 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

✨ What's new ✨

BREAKING

• User defined roles with the user-role-mappings feature used to require
  role- prefix but didn't work, now they require role: prefix and do work

Release

• #3196 Fix Debian 13 dependency libyara issue
• #3205 arkime_config_interfaces.sh -n with dash fix
• #3211 Node 20.19.2
• #3231 No longer use screwdriver, only github actions, goodbye el7
• #3233 EL10 initial support
• #3244 Support make DESTDIR install

All

• #3237 Add missing settings to addUser.js/arkime_add_user.sh

Viewer

• #3199,#3200 Support searchable snapshots with partial- index prefix
• #3218 Elasticsearch 9 dstats fix
• #3224 Fix/Change user-role-mappings must start with role: instead of role-

Capture

• #3209 New espSavePackets setting
• #3229 Drop packets larger than 0xffff in size

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2025.

Installation Instructions | 4.x -> 5.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from 5.1.2 or earlier

✨ What's new ✨

Viewer

• #3188 Prevent more session prototype pollution with connections
• #3188 Improved receiveSession auth & index verification

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of provided library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. If you have a libssl version error, it is most likely that the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2025.

Installation Instructions | 4.x -> 5.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from 5.1.2 or earlier

✨ What's new ✨

Release

• #3173 Initial Debian 13 support

Capture

• #3175 Don't include dns.host.tokens in host query
• #3177 support autoGenerateId=consistent to reprocess into same sid

Multies

• #3176 Fix issues when clusters are down (thanks @DavidCHIA-Rub)

Viewer

• #3164 Support searchable snapshots with partial- index prefix
• #3167, #3169 Prevent more session prototype pollution
• #3170 Add error handling for unknown views

⬇️ Download Info ⬇️

We offer downloads for different Linux distributions and versions because of provided library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. If you have a libssl version error, it is most likely that the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2025.