Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from Arkime 5 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

:sparkles: What's new :sparkles:

BREAKING

• [#3874] The user-auto-create and user-role-mappings sections now limit what loop and exception Javascript can be used for security.
• [#3881] Command sockets now chmod(0660) and removes Other access.

Release

• [#3864] CyberChef 10.23.0
• [#3870] docker.sh supports generic --db with help examples

All

• [#3831] New TOTP support for wise config instead of code - requires db.pl upgrade
• [#3865] Add syslog notifier
• [#3866] Add snmp notifier
• [#3888] Can now use - for password with addUser.js to get prompted

Capture

• [#3871] Packets with more than 10 ip/ethernet headers are now marked as corrupt
• [#3896] Improve MQTT parsing and tests

Capture/Viewer

• [#3833] New simpleDEKEncoding setting which controls how the DEK is encrypted
• [#3857] Fix scheme pcapNG not handling large files (thanks @wegman12)

db.pl

• [#3860] Add --compression option

Viewer

• [#3842] Add internationalized aria-labels
• [#3863] Add per-cluster serverSecret in S2S auth for multicluster pcap retrieval
• [#3878] Add JWT decoding support for header auth mode
• [#3877] Add ESIndices codec column
• [#3891] Improve tcp reassembly display when packets are retransmitted

:arrow_down: Download Info :arrow_down:

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2026. The EL 8 builds will stop in April 2026, please upgrade.