Arkime (Moloch)

arkime> session search

Searches sessions in Arkime's full packet capture index, finding a host's or IOC's communications in seconds across months of pcap.

Run it when you have Arkime (formerly Moloch) indexing the segment's pcap and need to find a specific communication: searching sessions by IP, port, protocol, or content returns matching connections with their associated pcap, ready to replay or analyze. It's the standard for network IR with full capture: the pcap of ALL traffic, indexed and queryable — the question 'did this host talk to this IP on day X?' is answered in seconds. In IR, the C2 session found in Arkime is the evidence connecting the endpoint to the attacker's infrastructure.

Don't use it if there's no full capture: Arkime only searches what was captured — without the sensor on the segment (or with short rotation), the answer is partial. Content searches (strings) require the text index and are slower than metadata searches: for quick triage, filter by IPs and ports. And watch the deployment: Arkime needs the Elasticsearch cluster and the sensor with space for the pcap (storage is the real cost of full capture). For a loose pcap, tshark/Zeek are more direct; Arkime is for the continuously monitored segment.