Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from Arkime 5 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

:sparkles: What's new :sparkles:

Breaking

• [#4233] Settings that restrict access or bound a resource are now checked when the config loads, and a bad value stops the service instead of being silently ignored. The startup error names the setting and what it expected. Checked: userAuthIps, mcpAllowedIps, mcpMaxQueryDays, authJwtClockSkew, uploadFileSizeLimit, maxSessionsQueried, elasticsearch, usersElasticsearch, cont3xt itypes, and the wise excludeIPs, onlyIPs and reversedns ips.
• [#4233] A list setting entry containing a space is no longer silently dropped, and a yaml key with no value now means unset
• [#4283] mcpEnabled with the default header mcpAuthMode now requires userNameHeader, and requiredAuthHeader now requires requiredAuthHeaderVal, otherwise the service refuses to start
• [#4283] Form login no longer accepts the username and password in the url query string

Release

• [#4260] Add esproxy to docker.sh (thanks @rht-jbittner)
• [#4270] CyberChef 11.4.0

All

• [#4215] Fix email searches, periodic queries and cont3xt history deletes ignoring permissions that come from a role instead of the user (thanks @Juwon1405)
• [#4233] Fix a malformed userAuthIps or mcpAllowedIps entry allowing every source ip, and an empty userAuthIps denying every request
• [#4233] Fix an expired JWT still verifying, and the mcp query window, upload size and session query limits being ignored, when the setting was not a number
• [#4233] Fix a /0 CIDR matching a single address in excludeIPs/onlyIPs and the wise and cont3xt ip sources
• [#4259] MCP tool results now include a link that opens the same query in the viewer or cont3xt web ui, built from arkimeWebURL
• [#4283] Two-factor authentication can only be set up by the user themselves
• [#4283] Fix a user's search restrictions briefly not applying while their roles update at login

Capture

• [#4217] Fix HTTP/2 sessions leaving http.uri empty, only http.uri.path was filled in
• [#4223] Fix JA4 being wrong when the TLS/DTLS client hello has GREASE values in the signature algorithms extension
• [#4271] Fix JA4 reading an ALPN value past the ALPN list length in a malformed client hello, it is now 00 like other JA4 implementations
• [#4224] Add ssdp parser
• [#4224] Add dhcp.yiaddr, the server assigned address from OFFER/ACK, and dhcp.paramReqList, the parameter request list
• [#4224] Add DNS PTR and SRV answer parsing
• [#4284] Fix a crafted CAMEL (TCAP) packet hanging a packet thread forever
• [#4284] Fix IPv4 fragments never being reassembled when the last fragment arrived first
• [#4284] Fix pcap filenames, S3 keys and WISE field definitions being written unescaped into Elasticsearch requests, which could add or change documents and broke --skip/--reprocess for some filenames
• [#4284] Fix SQS messages being able to point capture's signed S3 requests at another host or bucket, and S3 keys with special characters failing to load
• [#4284] Fix crashes from a _closeNow rule matching while a session was being saved, a WISE field definition with an unknown field and no db:, and a fields entry with no type

Cont3xt

• [#4265] The MCP search tool now answers with the overview for each indicator instead of every integration's raw data, which could be far more than an assistant can read at once. Ask for detail=full to get the raw data, and use cont3xt_integration_search to pull one integration.
• [#4265] Add mcpMaxResultBytes, a cap on the size of an MCP tool result; entries over it are dropped and marked omitted rather than truncated silently
• [#4265] Add mcpDefaultView, the view an MCP search uses when the assistant doesn't pick one
• [#4265] MCP searches can now record tags in the cont3xt history, and web ui links carry them
• [#4228] Update the Censys integration to the new Censys Platform API; it now needs a personal access token instead of an api id and secret
• [#4229] Replace the BGPView integration with RIPEstat, BGPView shut down in November 2025
• Remove the PassiveTotal integration, the API was retired by Microsoft

ESProxy

• [#4264] Fix a sensor being able to reach any Elasticsearch API through esProxy by percent-encoding a ? or # in the url

Parliament

• [#4283] Fix crashing on a notifier with a mixed case type or a non text field value

Viewer

• [#4216] Fix multi viewer hanging or failing queries when one cluster is down or unhealthy (thanks @Juwon1405)
• [#4222] Fix session PCAP/CSV export success toast showing "[object Object]"
• [#4241] Fix the entire session pcap download ignoring the user's forced expression on segments
• [#4262] Fix session queries not enforcing a timeLimit that comes only from a role instead of the user
• [#4263] Fix users with hidePcap or disablePcapDownload still being able to view packets through CyberChef
• [#4283] Fix pivot and click to search values from captured traffic being able to change the rest of the search

WISE

• Remove the PassiveTotal source, the API was retired by Microsoft
• [#4283] Fix saving the config from the web ui being able to add settings that weren't edited
• [#4285] urlapi sources can use {valueBase64} and {valueBase64Url} in the url for apis that want the value base64 encoded

:arrow_down: Download Info :arrow_down:

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2026. The EL 8 builds will stop for Arkime 7.