Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from Arkime 5 or earlier

Support Arkime's ongoing development! Become a Sponsor!

:sparkles: What's new :sparkles:

Breaking

• [#4072] WISE reversedns now returns resolved names that match none of the stripDomains entries in full (as documented) instead of silently dropping them
• [#4073] The cont3xt Arkime integration searchDays setting now searches that many days instead of 7x that many. Existing configs that relied on the wider window must increase searchDays to keep the previous range.
• [#4073] The cont3xt redis integration now substitutes 'domain' (not 'domainip') for %type% in keyTemplate on domain lookups. Deployments that stored domain data under the old 'domainip' key must re-key it as 'domain'.

Release

• [#4066] Node 22.23.1
• [#4056] Add Fedora 44 builds
• [#4102] FreeBSD 14 builds use 14.4

All

• [#4065] Fix OIDC login not preserving the redirect URL's query parameters (thanks @yanover)
• [#4072] Fix header/OIDC auth requests hanging when a dynamic role update fails
• [#4074] Harden user-auto-create/user-role-mappings expressions to run in strict mode
• [#4079] Fix relative time +1M (month) and @M snapping being silently ignored; lowercase m still means minutes
• [#4089] Consolidate header auth non-localhost host security warning across viewer/cont3xt/parliament/wiseService
• [#4093] Fix page load failing with a 500 in OIDC mode when the issuer has no end_session_endpoint
• [#4093] Fix user-role-mappings changes not taking effect until the next request; granted roles now apply and revoked roles stop working on the same request
• [#4102] Fix concurrent requests during the first roles-cache population getting an undefined roles list
• [#4102] Fix users CSV export header using comma-space separators while data rows use commas

Capture

• [#4054] Fix GRE keepalive packets adding bogus 00:00:00:00:00:00 MACs
• [#4055] Fix DNS memory leak when parsing malformed answers
• [#4068] Add some missing http methods to parser
• [#4074] Fix Geneve packets with protocol type 0 adding bogus 00:00:00:00:00:00 MACs
• [#4074] Fix pcap-over-IP client reader not connecting to IPv6 endpoints
• [#4078] Fix radiotap headers >= 256 bytes parsing at the wrong offset (it_len read as 8-bit instead of 16-bit)
• [#4078] Fix Linux cooked (SLL) VLAN frames misdispatching non-IP payloads to IP and not recording the VLAN id
• [#4078] Classify Control4 SDDP as sddp instead of mislabeling it ssdp
• [#4079] Fix CAMEL recording the TCAP invokeID as a bogus operation code, and ENIP CIP class extraction failing on routed request paths with a port segment
• [#4089] Fix netmap reader out-of-bounds ring index when netmapThreads doesn't evenly divide the interface's RX ring count
• [#4089] Fix file reader silently stopping on EINTR instead of retrying
• [#4089] Fix directory monitor leaking watch state when a watched directory is deleted
• [#4090] Add new zeekintel plugin that can read Zeek intel framework files and tag/annotate sessions whose ips, hosts, urls, emails or hashes match a loaded indicator
• [#4091] Fix ICMPv6 home-agent-reply (type 145) community-id not matching other tools or the reverse direction
• [#4091] Fix IKEv2 parsing issues
• [#4091] Fix MQTT parser PUBLISH issues
• [#4091] Fix s3:// directory listing silently dropping pages after the first when the bucket needs continuation requests
• [#4091] Rename misspelled protocol classifier stream-ihscp to steam-ihscp (Steam In-Home Streaming Control Protocol)
• [#4093] Fix tagger and zeekintel plugins potentially cross-matching IPv4 and IPv6 entries whose leading bits coincide; IPv4 entries are now stored v4-mapped in the shared tree
• [#4095] Fix python packet callbacks crashing capture when the callback returns a non-int (e.g. None)
• [#4095] Fix s3:// reader dropping the X-Amz-Security-Token header with s3PathAccessStyle, breaking STS/IAM temporary credentials
• [#4095] Fix pcap-over-IP treating nanosecond pcap timestamps as microseconds
• [#4095] Fix tpacketv3 fanout ids overflowing into the fanout mode with multiple interfaces and a large tpacketv3ClusterId
• [#4095] Fix ARKIME_ env vars whose value contains __ creating garbage config sections
• [#4095] Fix lua plugin crashing at startup when luaFiles is present but empty
• [#4095] Fix lua tcpflags.fin/tcpflags.urg session gets returning nil, and a Lua registry leak on every completed HttpService request
• [#4097] Fix session-command processing throttle never engaging when the packet queue is 75% full
• [#4097] Fix s3:// directory listing stopping early when a listing page contains no pcap files
• [#4097] Fix ARP and NBNS session-detail IP clicks/exports building nonexistent ip.arp/ip.nbns expressions
• [#4097] Fix cert:certificate-authority testing the cRLSign keyUsage bit instead of keyCertSign, and keyUsage being ignored when subjectAltName precedes it
• [#4097] Fix HTTP CONNECT tunnels hashing server tunnel bytes into http.md5/sha256 and never releasing the http parser
• [#4097] Fix RDP parser silently desyncing when the reassembly buffer overflows (now tagged rdp:frame-too-long)
• [#4097] Fix S7comm reading fields from the next buffered TPKT frame when COTP/S7 lengths are bogus
• [#4097] Fix SCTP reassembly corrupting messages when fragments of different streams interleave
• [#4098] Fix M2UA Protocol Data 2 messages including the length-indicator octet in the MTP3 payload, corrupting decoded SS7 fields
• [#4098] Fix MQTT parser desyncing on messages too large for the reassembly buffer (now tagged mqtt:message-too-long)
• [#4098] Fix NBNS only parsing the first packet in each direction of a session
• [#4098] Fix synchrophasor CFG-3 frames misparsing PMU names after the first (digital channel name count and PHSCALE size)
• [#4098] Fix ospf.msgType exact searches failing because the field was declared lowercase but stores mixed-case values
• [#4098] Fix tagger plugin not removing IPv4 ip entries when a tagger file is reloaded or removed
• [#4098] Fix session detail issues: RADIUS missing Msg Type/NAS IPs/NAS Port fields, SIP User-Agent menus building a nonexistent sip.useragent expression, and cert JA4x_r row layout
• [#4098] Fix lua sample smb.lua FSCTL and Find subcommand names never matching
• [#4100] Fix draft-v6 M3UA Protocol Data (tags 2/3) being parsed with the RFC 4666 structured layout instead of as raw MTP3
• [#4100] Fix M2UA/M3UA associations captured from the ASP handshake never being classified, and control messages unregistering the parser
• [#4100] Fix SNMP recording a bogus GetResponse type for non-PDU content, and version-2u sessions being tagged snmp with no fields
• [#4100] Fix SSH hassh being computed over bytes of the following record when a KEXINIT name-list length is corrupt
• [#4100] Fix synchrophasor parser silently desyncing when the reassembly buffer overflows (now tagged synchrophasor:frame-too-long)
• [#4100] Fix WebSocket text/close frames spanning TCP segments losing their sample/code/reason, and continuation frames after an interleaved Ping losing text samples
• [#4100] Fix JA3/JA3S edge cases: truncated server extension header injected a fake extension into JA3S, and empty/all-GREASE extension or curve lists suppressed JA3 entirely
• [#4100] Fix Modbus recording a bogus exception code from truncated exception frames, and mislabeling requests/responses when the server is the session initiator
• [#4100] Fix modbus/dnp3/enip parsers silently desyncing when the reassembly buffer overflows (now tagged frame-too-long)
• [#4100] Fix M2UA/M3UA associations carrying multiple service indicators (e.g. ISUP + SCCP) only parsing the first one
• [#4100] Fix MQTT PUBLISH messages with topics too large to buffer being tagged mqtt:bad-publish instead of mqtt:message-too-long
• [#4100] Fix Oracle TNS connect strings of 256 bytes or more never being classified
• [#4100] Fix SIP over TCP not classifying sessions opening with OPTIONS, and PUBLISH requests not recording a method
• [#4100] Fix padded RADIUS datagrams never being classified, and a malformed attribute dropping all attributes after it
• [#4100] Fix netflow plugin exporting per-thread flow sequence numbers, which collectors saw as massive loss/duplication, and reject SNMP ifIndex settings over 65535 (16-bit on the wire)
• [#4100] Fix wise plugin lookups too large for the request buffer being silently truncated off the wire request, and inflight counter races
• [#4100] Fix kafka plugin only using the first bootstrap server of a semicolon-separated kafkaBootstrapServers list
• [#4100] Fix writer-s3 building corrupt CompleteMultipartUpload requests after a failed part upload (now aborts the upload), leaking queued buffers forever when multipart init fails, and capture exiting when a periodic credential refresh fails
• [#4100] Fix lua plugin HTTP MESSAGE_BEGIN callback only firing for the first message per direction on keep-alive connections
• [#4104] Fix tagger plugin crashing when an ES poll hit has no _id, and a memory leak when a hit has no md5
• [#4107] Fix python per-session parsers (register_parser/register_parser_buf) crashing capture when the callback is freed at session end without a Python thread state
• [#4107] Fix pcap-over-IP server exiting when a client sends truncated or oversized packet records; now skips the packet or closes just that connection
• [#4107] Fix http:// and https:// scheme reader dropping the URL query string (breaking pre-signed S3 style links) and silently ignoring HTTP error responses
• [#4107] Fix unknown-ether session ids reading past the end of short packets (e.g. truncated Frame Relay)
• [#4107] Fix IPv6 headers past offset 2047 (deep encapsulation) recording wrong session addresses; now treated as corrupt like IPv4
• [#4107] Add awsUseTokenForMetadata option to use IMDSv2 when fetching AWS credentials from the metadata service

Capture/Viewer

• [#4054] Add mpacket link layer support

Cont3xt

• [#4073] Fix search and single-integration refresh hanging when an integration errors or returns no data
• [#4073] Fix integration cacheTimeout values specified in milliseconds being treated as seconds (1000x too long); short-TTL integrations like DNS now expire on time
• [#4073] Fix csv/json integrations sometimes failing to load JSON feeds over http/elasticsearch/opensearch
• [#4073] Fix ClickHouse integration being broken (wrong search method name and unawaited result parsing)
• [#4093] Fix cont3xt crash with a malformed custom overview field, and custom overview join separators being rejected
• [#4093] Fix searches hanging when an invalid IP (e.g. 300.1.2.3) is the only indicator queried
• [#4093] Fix ipqs array fields not displaying comma-joined, the virustotal hash scans table never rendering, and the wise integration ignoring wiseURL
• [#4102] Fix DNS integration decoding the CAA critical flag as decimal instead of hex
• [#4102] Fix builtwith/greynoise/redis integrations silently swallowing errors (bad key, rate limit, outages) as no data; they now log
• [#4102] Fix db errors without ES metadata throwing inside index-creation error handlers

db.pl

• [#4102] Fix ARKIME__prefix/ARKIME_default__prefix env prefixes not being normalized like --prefix (missing trailing _)
• [#4102] Fix info command counting old-prefix history indices but excluding their docs/bytes from Histories

Multies

• [#4092] Fix plaintext user:pass elasticsearchBasicAuth never working, and passwords containing a colon being truncated

Parliament

• [#4102] Fix parliament upgrade polluting the shared settings defaults, which broke restoring default settings until restart
• [#4102] Fix issue cleanup sometimes removing an extra unrelated issue in the same pass
• [#4102] Fix noPackets tracking not resetting when a node recovers, so a later dip alerted immediately instead of waiting noPacketsLength

Viewer

• [#4063] Fix CSV formula injection in the summary CSV export by neutralizing cells starting with = + - @
• [#4071] Fix negative numbers being rejected in expressions
• [#4076] Fix raw packet search hunts hanging when a session's PCAP is missing or unreadable
• [#4079] Fix /api/upload storing the upload to disk before authorization
• [#4079] Fix /api/esindices/:index/shrink leaving the index read-only when shard relocation stalls
• [#4092] Fix periodic queries silently processing at most 1000 sessions per run
• [#4092] Fix hunts stalling instead of skipping the session when a failed session can't be fetched on retry
• [#4092] Fix GRE packets with the routing bit set being misparsed in the viewer pcap decoder
• [#4093] Fix SPI Graph fileand rows showing node-level data instead of per-file data
• [#4094] Fix history not recording the view name and expression used for a search since views moved to their own index
• [#4094] Fix viewer pcap decoder issues: radiotap headers >= 256 bytes, NFLOG reading garbage offsets when no payload found, and SLL2 always decoding as IPv4
• [#4094] Fix raw packet search hunts matching bytes in pcap record headers when searching both directions
• [#4094] Fix multies GET _search crashing when one cluster returns an error
• [#4094] Fix map data still being computed when map=false is sent with facets
• [#4096] Speed up the Connections and SPIView pages when there are 1000s of fields by lazily rendering field menus/categories and batching SPIView show/hide-all toggling
• [#4098] Fix hunts configured with multiple notifiers only notifying the first one
• [#4098] Fix stats gathering polluting the shared nodes-stats cache with a bogus timestamp pseudo-node that showed up as an extra ES node
• [#4098] Fix viewer pcap decoder GTP inner packet byte positions being off by 8 (UDP header not counted)
• [#4098] Fix expression list values with multiple escaped commas or backslashes only unescaping the first one
• [#4098] Fix IP field Add Exists menu items building queries with the database field name instead of the expression
• [#4098] Fix session detail Src/Dst payload preview not replacing unprintable characters
• [#4098] Fix PCAP retrieval with the writer-s3 plugin hanging queued readers forever when the S3 object is gone
• [#4101] Fix s3ExpireDays never expiring anything in the writer-s3 plugin
• [#4102] Fix pcap scrub silently skipping packets larger than 5000 bytes (jumbo frames / large snaplen)
• [#4102] Fix pcap scrub on short-header pcap files leaving the first 10 payload bytes unscrubbed
• [#4102] Fix session packets requests with an unknown decode option hanging forever; they now return a 400
• [#4102] Fix a session packets error when an SMTP MIME header continuation line lands on a packet chunk boundary
• [#4102] Fix multiviewer sessions refresh dropping each cluster's index prefix, so prefixed clusters were never refreshed
• [#4103] Time picker displays YYYY/MM/DD HH:mm:ss again instead of the browser locale format, allows typing/pasting dates, and adds a date picker button
• [#4104] Fix PCAP retrieval with the writer-s3 plugin hanging queued readers forever when block decompression fails
• [#4104] Fix writer-s3 PCAP retrieval of multi-file sessions with pre-compression file records computing bogus byte ranges
• [#4105] Fix time picker inputs showing local wall clock time in UTC mode; typed/pasted times are now interpreted in the displayed timezone and may include a timezone suffix (UTC, EDT, America/Chicago, +02:00)
• [#4106] Fix payload8 UTF8/Hex fields: the sessions column and info field showed the UTF8 label with the hex value, and clicking the value built a broken payload8.*.utf8 expression
• [#4108] Fix receive endoint S2S auth bypass via browser session - fully validate auth token (path/user/date/method)
• [#4110] Fix S2S receive-session requests failing on form/oidc auth with "Failed to serialize user into session"

WISE

• [#4072] Fix /get stalling the entire query batch until a timeout when a single source errors
• [#4072] Fix urlapi source failing every lookup (double JSON parse) and reporting 404 misses as errors
• [#4072] Fix databricks periodic mode never running the initial query and crashing on refresh
• [#4072] Fix caching md5/sha256 results without contentType, and crashes on repeated hashes params and on viewing an empty redisfile source
• [#4092] Fix threatstream zip mode not working
• [#4092] Fix virustotal v2 issues
• [#4092] Fix opendns content category field being labeled Security instead of Content
• [#4093] Fix opendns, passivetotal, and virustotal queries hanging forever when an upstream request fails
• [#4093] Fix wiseService crashing when a watched file source file is deleted
• [#4093] Fix isepxgrid serving stale identities for up to cacheAgeMin and disconnects deleting a reassigned IP's newer session
• [#4093] Fix elasticsearch source registering anyway after logging that required settings are missing
• [#4094] Fix fieldactions/valueactions crashing wiseService when the watched file is deleted, and redis/elasticsearch content with a section header failing to load
• [#4094] Fix databricks and splunk sources loading anyway when required settings are missing
• [#4102] Fix isepxgrid showing a duplicate cacheAgeMin field in the config UI
• [#4102] Fix taggerUpload.pl corrupting keys from CRLF files and building invalid JSON when data contains quotes or backslashes

:arrow_down: Download Info :arrow_down:

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2026. The EL 8 builds will stop for Arkime 7.