Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from Arkime 5 or earlier

Support Arkime's ongoing development! Become a Sponsor!

:sparkles: What's new :sparkles:

Breaking

• [#4309] esProxy refuses to start if an esproxy-sensors entry has an empty pass or ip, or neither
• [#4309] esProxy rejects query parameters that capture and viewer don't send, including extra parameters added to esBulkQuery
• [#4338] WISE and Cont3xt Databricks connections now verify TLS certificates, set insecure=true in the databricks section to skip
• [#4343] Viewers behind esProxy MUST use authMode=s2s
• [#4345] esproxy-sensors entries without host are locked to the hostname the sensor first reported, set host if a sensor's hostname changes
• [#4348] authMode=basic+header now only allows localhost until userAuthIps is set, the same as the other header modes
• [#4350] Refuse to start if requiredAuthHeaderVal is set without requiredAuthHeader
• [#4350] SNMPv3 notifiers with an unknown auth or privacy protocol, privacy without auth, or a key without its protocol now fail instead of sending unprotected traps

Release

• [#4306] Fix docker.sh ignoring docker stop, capture now finishes writing its open pcap files (thanks @usmanTheCoder)
• [#4313] Node 22.23.3
• [#4316] Cyberchef 11.5.0

All

• [#4352] Basic and digest auth no longer use the unmaintained passport-http module

Capture

• [#4313] Fix TLS and QUIC SNI and JA4 sometimes missing when the Client Hello is split or retransmitted
• [#4313] Fix HTTP/2 headers being wrong or missing on busy connections
• [#4313] Fix the first HTTP/2 or WebSocket frames sent with a 101 upgrade response being skipped
• [#4313] Fix UDP traffic on VXLAN, Geneve and GTP ports being dropped when it isn't tunneled traffic
• [#4313] Fix a spoofed RST or FIN splitting a TCP session and hiding the rest of the traffic
• [#4313] Fix DNS, HTTP, FTP, SIP, SMTP and STUN parsing stopping early or recording wrong values on unusual but valid traffic
• [#4314] Fix DTLS and QUIC SNI and JA4 missing for fragmented DTLS Client Hellos and QUIC v2
• [#4314] Fix SMB file names, shares and users missing for SMB on port 139 and for compound or chained commands
• [#4314] Fix HTTP paths and tags missing for requests without a Host header, unusual paths, or plain HTTP through a CONNECT proxy
• [#4314] Fix DNS queries with invalid punycode being dropped, SIP parsing stopping on long connections, and spoofed SCTP packets being parsed
• [#4314] GRE that can't be decoded is now saved as a session when saveUnknownPackets includes ip:gre
• [#4315] Fix WISE lookups being skipped for some sessions on busy sensors
• [#4315] Fix pcap files being lost when S3 uploads back up, and S3 reading hanging on very long object keys
• [#4315] The snf and netmap readers now apply the bpf setting
• [#4315] Fix the Lua pattern_ismatch function being able to crash capture
• [#4340] New _maxPackets rule op to override maxPackets for matching sessions
• [#4347] Fix crafted DNS traffic being able to use excessive CPU and memory
• [#4347] Fix WISE lookups on very busy sessions being able to crash capture
• [#4347] Fix offline reading hanging after an empty pcap file
• [#4347] Fix a crafted SQS message being able to crash capture
• [#4347] Fix s3:// and sqs:// reading failing or crashing after AWS credentials rotate

Cont3xt

• [#4300] Fix some indicators that aren't domains being sent to domain integrations
• [#4328] Fix requests and large integration settings that could crash Cont3xt
• [#4348] Results from a user's own integration keys or host are no longer shared with other users
• [#4348] Fix URL searches sending more than the domain to domain integrations
• [#4348] Fix saving integration settings undoing an admin disabling the user or removing roles
• [#4348] New urlapi integration to look up indicators in your own JSON api, see https://arkime.com/settings#cont3xt-urlapi
• [#4350] Fix searches never finishing or being left out of history when an integration doesn't answer, new searchTimeout setting (default 2m)
• [#4350] Fix long searches or tags being left out of history, searches allow at most 50 tags

db.pl

• [#4312] Fix users-update --removeRole usersAdmin not removing usersAdmin
• [#4312] Fix initorupgrade erasing everything when OpenSearch/Elasticsearch returns an error
• [#4312] backup, export and users-export files are now only readable by the owner
• [#4312] expire/rotate now reject an invalid <num> or --history instead of deleting indices

ESProxy

• [#4300] Fix a capture node being able to make Elasticsearch requests esProxy should block
• [#4309] Fix a capture node being able to read and change other indices through esProxy
• [#4309] Fix some viewer and capture requests being wrongly rejected by esProxy
• [#4342] Fix more ways a capture node could get around esProxy, new optional host setting in esproxy-sensors
• [#4330] Rejected bulk and POST request bodies are now only logged with --debug, rejected bulk logs name the failing command (thanks @rht-jbittner)
• [#4343] Fix a capture node being able to read user hashed passwords, TOTP secrets and Cont3xt keys through esProxy
• [#4345] Fix more ways a capture node could read other nodes' data or change sessions, fields and stats through esProxy
• [#4352] Fix a capture node being able to read or hunt other hosts' sessions and write history entries through esProxy
• [#4362] Fix esProxy to only allow valid files search queries

Parliament

• [#4325] Fix a monitored cluster being able to hang or slow down Parliament
• [#4325] Fix issue search and the dashboard failing for some node names

Viewer

• [#4300] Fix users with a time limit being able to search outside of it
• [#4300] Fix Connections CSV export not quoting values
• [#4315] Fix viewing packets or uncompressed bodies from some sessions using excessive memory
• [#4324] Transferring a periodic query to another user now disables it and clears its edit roles
• [#4329] Fix requests that could crash or hang the viewer
• [#4329] Fix crafted session ids being able to read data outside of the sessions indices
• [#4329] Fix another way users with a time limit could search outside of it
• [#4329] Fix the hunt session limit being bypassable
• [#4329] Fix role assigners being able to create a circular role
• [#4327] Fix a capture node being able to run code in the viewer or browser through custom-views field labels
• [#4335] Fix History not logging searches with a very long time range
• [#4341] Fix unique values returning an empty list instead of an error when the search fails
• [#4342] Fix captured traffic and some requests being able to hang or crash the viewer
• [#4342] Fix users being able to search outside their time limit or use notifiers not shared with them
• [#4342] Fix some requests not being recorded in History
• [#4345] Fix a capture node being able to make pcap expiry delete files outside the pcap directories
• [#4345] Fix a capture node being able to break the field list or stats pages for every viewer
• [#4350] Fix MCP header auth changing a user's roles from request headers when authMode isn't a header mode
• [#4350] Fix /mcp accepting form posts, so another web site can't make MCP calls as a logged in user
• [#4350] Fix periodic query alerts including unsanitized tags
• [#4350] Fix a notifier listed more than once on a periodic query or hunt sending duplicate alerts
• [#4351] Fix a crafted search expression being able to hang the viewer, malformed number ranges are now rejected
• [#4359] Fix session detail not encoding some fields in links

WISE

• [#4300] Fix a lookup request being able to crash wiseService
• [#4338] urlapi sources support insecure=true to skip TLS certificate verification

:arrow_down: Download Info :arrow_down:

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2026.