Installation Instructions | 5.x -> 6.x Upgrade Instructions | FAQ | CHANGELOG | JA4+ Install | Docker Install

A db.pl upgrade is required when upgrading from Arkime 5 or earlier

Support Arkime's ongoing development! Become a GitHub Sponsor!

:sparkles: What's new :sparkles:

Breaking

• #4005 userAuthIps is now correctly matched against the real connecting peer address. Deployments behind a proxy must ensure the proxy's own address is covered by userAuthIps when authTrustProxy is used.

Release

• #4004 Fix Ubuntu 26.04 builds having the incorrect dependencies

All

• #4030 Fix hidePcap/hideFiles/hideStats/disablePcapDownload failing open for users with the permission inherited from multiple roles
• #4031 Fix CSV formula injection in session, connection, and user CSV exports by neutralizing cells starting with = + - @

Capture

• #3996 Added mssing ntlm.detail.jade for NTLM session detail rendering
• #3996 Added opcua parser (OPC UA Binary) with opcua.endpointUrl, opcua.securityPolicyUri and SenderCertificate parsing
• #3997 Added IPFIX and sFlow v5 classifiers for flow telemetry visibility
• #3997 Added DCERPC interface labels for AD CS (MS-WCCE/ICPR), PrintNightmare (MS-RPRN/MS-PAR), DfsCoerce, ShadowCoerce, WMI, BackupKey (BKRP), EventLog6, DFS-R (FRS2), and IObjectExporter
• #3998 Identify AD CS web enrollment over HTTP (ESC8) as protocols adcs-web/adcs-ndes/adcs-cep/adcs-ces based on URL path
• #3998 Identify RPC-over-HTTP (Outlook Anywhere / RPC Proxy) as protocol rpc-over-http via RPC_IN_DATA/RPC_OUT_DATA verb classifiers
• #3998 Identify WinRM / WS-Management (PowerShell Remoting, evil-winrm, WEF) as protocol winrm via POST /wsman
• #3999 Add DCERPC labels (even, mapi, iwbemlevel1login, msrp, dnsserver) and fix IRemUnknown/IRemUnknown2/ISystemActivator/ioxidresolver mislabels
• #4008 Extract arp.ip / arp.mac / arp.oui / arp.opcode from ARP packets
• #4010 Fix crash on startup when rootPlugins is set
• #4013 Add entropy plugin to calculate the Shannon entropy of the TCP/UDP data bytes per direction, with entropyChunkSize and entropyMaxUniqueValues options
• #4015 Initial napatech reader implementation (thanks @waynieack)
• #4019 Fix TCP flow split into two sessions when a reordered original SYN (arriving after FIN/RST, e.g. across multiple capture interfaces/reader threads) was mistaken for a port reuse
• #4021 Fix hunts and PCAP retrieval stalling with the writer-s3 plugin when a session's file is missing
• #4023 Fix TLS parser dropping the server hello/certificate when the entire client direction was processed before the server's ServerHello
• #4024 Fix ESP sessions labeled with reverse direction
• #4024 Fix DNS/TLS templates
• #4024 Fix TCP/SCTP reassembly failure on U32 wrap in some cases
• #4024 Fix HTTP DELETE request Host/Cookie/Authorization headers being treated as response headers
• #4024 Fix SMTP Q-encoded header and AUTH decoding
• #4025 Fix HTTP request/response header mislabeling on reversed-direction sessions
• #4025 Fix S7comm function code 0x00 mislabeled as "Setup communication" (now "CPU services")
• #4025 Fix CAMEL/CAP operation code table to match 3GPP TS 29.078
• #4025 Fix DNS EDNS(0) extended RCODE (BADVERS..BADCOOKIE) not being decoded
• #4025 Fix TLS certificate enrichment crash when a cert has no extra fields
• #4025 Fix NetBIOS name decoding for embedded spaces, compressed names, and authority records
• #4026 Fix [packet-drop-ips] section in the main config file never being loaded (only packetDropIpsFiles worked)
• #4026 Fix IPv6 DSCP extraction using only the top 4 bits of the traffic class
• #4026 Fix rules file field modifier (contains/head/tail) on one field incorrectly applying to later fields in the same rule
• #4027 Fix wrong packetPos when reading truncated captures with readTruncatedPackets set
• #4030 Fix MQTT multi-topic UNSUBSCRIBE only extracting the first topic
• #4030 Fix SCTP reassembly losing messages after out-of-order delivery, causing spurious incomplete-sctp
• #4030 Fix SMB2 TREE_CONNECT share name not decoded for SMB2-only sessions
• #4030 Fix max-free-percent/max-free-bytes pcapDir selection lagging by one file

Cont3xt

• #3999 Fix logoutUrl when logoutUrlMethod=GET

Parliament

• #4028 Harden parliament against malicious Arkime clusters

Viewer

• #3994 Fix SPIView all not allowed error message
• #4007 Add sanitized {ORIGINALNAME} uploadCommand variable as a safe alternative to {INSECURE-ORIGINALNAME}
• #4018 Added support for preauth and postauth endpoint registration to plugins
• #4027 Fix viewer crash when /api/sessions/csv with ids fails to build the query
• #4027 Fix malformed TOTP codes causing a request error instead of being treated as invalid
• #4031 Fix potential stored XSS in session detail
• #4031 Fix stored XSS in hunt search string

Wise

• #3999 Mark phpipam appCode/password and fieldactions/valueactions url fields as secret so they are redacted in /config/get
• #3999 Add /api/user endpoint and hide save/import/create-source UI controls from non-wiseAdmin users

:arrow_down: Download Info :arrow_down:

We offer downloads for different Linux distributions and versions because of library differences. For example, use the el8 download for Centos 8 or RHEL 8 not RHEL 9. A libssl version error means that most likely the wrong download was used for your Linux distribution and version, please double check. The moloch builds have the old filesystem layouts, we will stop providing the moloch builds in 2026.