{"id":7993,"date":"2021-02-23T22:27:21","date_gmt":"2021-02-23T19:27:21","guid":{"rendered":"https:\/\/kifarunix.com\/?p=7993"},"modified":"2024-03-19T19:28:56","modified_gmt":"2024-03-19T16:28:56","slug":"install-arkime-moloch-full-packet-capture-tool-on-ubuntu","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-arkime-moloch-full-packet-capture-tool-on-ubuntu\/","title":{"rendered":"Install Arkime Full Packet Capture tool on Ubuntu"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1023\" height=\"418\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/install-arkime-moloch-ubuntu.png\" alt=\"Install Arkime (Moloch) Full Packet Capture tool on Ubuntu\" class=\"wp-image-7994\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/install-arkime-moloch-ubuntu.png?v=1614100073 1023w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/install-arkime-moloch-ubuntu-768x314.png?v=1614100073 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/install-arkime-moloch-ubuntu-150x61.png?v=1614100073 150w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/install-arkime-moloch-ubuntu-300x123.png?v=1614100073 300w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/install-arkime-moloch-ubuntu-696x284.png?v=1614100073 696w\" sizes=\"(max-width: 1023px) 100vw, 1023px\" \/><\/figure>\n\n\n\n<p>Welcome to our tutorial on how to install Arkime (Moloch) Full Packet Capture tool on Ubuntu 20.04\/Ubuntu 22.04\/Ubuntu 18.04. <a aria-label=\"Arkime (opens in a new tab)\" class=\"rank-math-link\" href=\"https:\/\/arkime.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">Arkime<\/a>, formerly Moloch<em> &#8220;is a large scale, open source, indexed packet capture and search system<\/em>&#8220;.<\/p>\n\n\n\n<p>Using Debian system? then check the guide below;<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/install-arkime-moloch-full-packet-capture-tool-on-debian\/\" target=\"_blank\" rel=\"noreferrer noopener\">Install Arkime (Moloch) Full Packet Capture tool on Debian 11<\/a><\/p>\n\n\n\n<p>According to its <a href=\"https:\/\/github.com\/arkime\/arkime\" target=\"_blank\" aria-label=\"Github repository (opens in a new tab)\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Github repository<\/a> page, some of the features of Arkime tool include;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>It stores and indexes network traffic in standard PCAP format, providing fast, indexed access.<\/li>\n\n\n\n<li>Provides an intuitive web interface for PCAP browsing, searching, and exporting.<\/li>\n\n\n\n<li>Exposes APIs which allow for PCAP data and JSON formatted session data to be downloaded and consumed directly.<\/li>\n\n\n\n<li>Stores and exports all packets in standard PCAP format, allowing you to also use your favorite PCAP ingesting tools, such as wireshark, during your analysis workflow.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Installing Arkime on Ubuntu<\/h2>\n\n\n\n<p>You can either install Arkime on Ubuntu using prebuilt binary packages or simply build it from the source yourself.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Installing Arkime using Prebuilt Binary on Ubuntu<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Download Arkime Binary Installer<\/h4>\n\n\n\n<p>In order to install Arkime using the prebuilt binary on Ubuntu, navigate to the <a aria-label=\"downloads page (opens in a new tab)\" class=\"rank-math-link\" href=\"https:\/\/arkime.com\/downloads\" target=\"_blank\" rel=\"noreferrer noopener\">downloads page<\/a> and grab the binary installer for your Ubuntu flavour, which in my setup is Ubuntu 22.04.<\/p>\n\n\n\n<p>You can as well grab the link to the binary installer and pull it using <code><strong>curl<\/strong><\/code> or <strong><code>wget<\/code><\/strong> command. For example, the command below downloads the current stable release version of Arkime binary installer for Ubuntu 22.04;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>wget https:\/\/s3.amazonaws.com\/files.molo.ch\/builds\/ubuntu-22.04\/arkime_4.1.0-1_amd64.deb<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Run System Update<\/h4>\n\n\n\n<p>Update your system package cache;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>apt update<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Install Arkime on Ubuntu<\/h4>\n\n\n\n<p>Next, install Arkime on Ubuntu using the downloaded binary installer.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>apt install .\/arkime_4.1.0-1_amd64.deb<\/code><\/pre>\n\n\n\n<p>If you want, you can as well build Arkime by building it from the source. Check the <a href=\"https:\/\/github.com\/arkime\/arkime#install\" target=\"_blank\" aria-label=\"installation page (opens in a new tab)\" rel=\"noreferrer noopener\" class=\"rank-math-link\">installation page<\/a> for instructions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Install Elasticsearch on Ubuntu<\/h3>\n\n\n\n<p>Arkime uses Elasticsearch as a search and indexing engine. Therefore, install Elasticsearch by running the command below;<\/p>\n\n\n\n<p>Import the Elastic stack PGP repository signing Key<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>wget -qO - https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch --no-check-certificate \\\n| sudo gpg --dearmor &gt; \/etc\/apt\/trusted.gpg.d\/elastic.gpg<\/code><\/pre>\n\n\n\n<p>Install Elasticsearch 7.x APT repository;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>echo \"deb https:\/\/artifacts.elastic.co\/packages\/7.x\/apt stable main\" \\\n| sudo tee -a \/etc\/apt\/sources.list.d\/elastic-7.x.list<\/code><\/pre>\n\n\n\n<p>Update package cache and install Elasticsearch;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>apt update<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>apt install elasticsearch<\/code><\/pre>\n\n\n\n<p>Configure Elasticsearch JVM options depending on the size of your memory;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/etc\/elasticsearch\/jvm.options.d\/heap.options<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code># Xms represents the initial size of total heap space\n# Xmx represents the maximum size of total heap space\n\n<strong>-Xms512m\n-Xmx512m<\/strong><\/code><\/pre>\n\n\n\n<p>Save and exit the configuration file.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Configure Arkime on Ubuntu<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Configuring Arkime<\/h4>\n\n\n\n<p>Once the installation is done, run the script below to configure Arkime;<\/p>\n\n\n\n<p>Check your interfaces;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ip a<\/code><\/pre>\n\n\n\n<p>Answer the script prompts accordingly;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>\/opt\/arkime\/bin\/Configure<\/code><\/pre>\n\n\n\n<p>Select an interface to monitor;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>Found interfaces: lo;enp0s3;enp0s8\nSemicolon ';' seperated list of interfaces to monitor [eth1] <strong>enp0s8<\/strong><\/code><\/pre>\n\n\n\n<p>Choose whether to install Elasticsearch automatically or you want to install manually yourself (<strong>We have already installed Elasticsearch, hence choose no<\/strong>).<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>Install Elasticsearch server locally for demo, must have at least 3G of memory, NOT recommended for production use (yes or no) [no] <strong>no<\/strong><\/code><\/pre>\n\n\n\n<p>Set Elasticsearch server URL, localhost:9200 in this setup. Just press Enter to accept the defaults.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>Elasticsearch server URL [http:\/\/localhost:9200] <strong>ENTER<\/strong><\/code><\/pre>\n\n\n\n<p>Set encryption password. Be sure to replace the password.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>Password to encrypt S2S and other things [no-default] <strong>changeme<\/strong><\/code><\/pre>\n\n\n\n<p>The configuration of Arkime then runs.<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\nArkime - Creating configuration files\nInstalling sample \/opt\/arkime\/etc\/config.ini\nDownload GEO files? You'll need a MaxMind account https:\/\/arkime.com\/faq#maxmind (yes or no) [yes] yes\nArkime - Downloading GEO files\n2023-02-08 15:20:47 URL:https:\/\/www.iana.org\/assignments\/ipv4-address-space\/ipv4-address-space.csv [23331\/23331] -> \"\/tmp\/tmp.NyJWPlYxE0\" [1]\n2023-02-08 15:20:47 URL:https:\/\/raw.githubusercontent.com\/wireshark\/wireshark\/master\/manuf [2093338\/2093338] -> \"\/tmp\/tmp.gykkD9TZqP\" [1]\n\nArkime - Configured - Now continue with step 4 in \/opt\/arkime\/README.txt\n\n 4) The Configure script can install OpenSearch\/Elasticsearch for you or you can install yourself\n 5) Initialize\/Upgrade OpenSearch\/Elasticsearch Arkime configuration\n  a) If this is the first install, or want to delete all data\n      \/opt\/arkime\/db\/db.pl http:\/\/ESHOST:9200 init\n  b) If this is an update to an Arkime package\n      \/opt\/arkime\/db\/db.pl http:\/\/ESHOST:9200 upgrade\n 6) Add an admin user if a new install or after an init\n      \/opt\/arkime\/bin\/arkime_add_user.sh admin \"Admin User\" THEPASSWORD --admin\n 7) Start everything\n      systemctl start arkimecapture.service\n      systemctl start arkimeviewer.service\n 8) Look at log files for errors\n      \/opt\/arkime\/logs\/viewer.log\n      \/opt\/arkime\/logs\/capture.log\n 9) Visit http:\/\/arkimeHOST:8005 with your favorite browser.\n      user: admin\n      password: THEPASSWORD from step #6\n\nIf you want IP -> Geo\/ASN to work, you need to setup a maxmind account and the geoipupdate program.\nSee https:\/\/arkime.com\/faq#maxmind\n\nAny configuration changes can be made to \/opt\/arkime\/etc\/config.ini\nSee https:\/\/arkime.com\/faq#arkime-is-not-working for issues\n\nAdditional information can be found at:\n  * https:\/\/arkime.com\/faq\n  * https:\/\/arkime.com\/settings\n<\/code><\/pre>\n\n\n\n<p>Sample Arkime config file;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/opt\/arkime\/etc\/config.ini<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\n# Latest settings documentation: https:\/\/arkime.com\/settings\n#\n# Arkime capture\/viewer uses a tiered system for configuration variables. This allows Arkime\n# to share one config file for many machines. The ordering of sections in this\n# file doesn't matter.\n#\n# Order of config variables use:\n# 1st) [optional] The section titled with the node name is used first.\n# 2nd) [optional] If a node has a nodeClass variable, the section titled with\n#      the nodeClass name is used next. Sessions will be tagged with\n#      class:<node class name> which may be useful if watching different networks.\n# 3rd) The section titled \"default\" is used last.\n\n[default]\n# Comma seperated list of OpenSearch\/Elasticsearch host:port combinations. If not using a\n# Elasticsearch load balancer, a different OpenSearch\/Elasticsearch node in the cluster can be \n# specified for each Arkime node to help spread load on high volume clusters. For user\/password\n# use https:\/\/user:pass@host:port OR elasticsearchBasicAuth\nelasticsearch=http:\/\/localhost:9200\n# elasticsearchBasicAuth=\n\n# Where the user database is, the above is used if not set\n# For user\/password use https:\/\/user:pass@host:port OR usersElasticsearchBasicAuth\n# usersElasticsearch=http:\/\/localhost:9200\n# usersElasticsearchBasicAuth=\n\n# How often to create a new OpenSearch\/Elasticsearch index. hourly,hourly[23468],hourly12,daily,weekly,monthly\n# See https:\/\/arkime.com\/settings#rotateindex\nrotateIndex=daily\n\n# Uncomment if this node should process the cron queries and packet search jobs, only ONE node should \n# process cron queries and packet search jobs\n# cronQueries=true\n\n# Cert file to use, comment out to use http instead\n# certFile=\/opt\/arkime\/etc\/arkime.cert\n\n# File with trusted roots\/certs. WARNING! this replaces default roots\n# Useful with self signed certs and can be set per node.\n# caTrustFile=\/opt\/arkime\/etc\/roots.cert\n\n# Private key file to use, comment out to use http instead\n# keyFile=\/opt\/arkime\/etc\/arkime.key\n\n# Password Hash Secret - Must be in default section. Since OpenSearch\/Elasticsearch\n# is wide open by default, we encrypt the stored password hashes with this\n# so a malicous person can't insert a working new account.\n# Comment out for no user authentication.\n# Changing the value will make all previously stored passwords no longer work.\n# Make this RANDOM, you never need to type in\npasswordSecret=password\n\n# Use a different password for S2S communication then passwordSecret.\n# Must be in default section. Make this RANDOM, you never need to type in\n#serverSecret=\n\n# HTTP Digest Realm - Must be in default section. Changing the value\n# will make all previously stored passwords no longer work\nhttpRealm=Moloch\n\n# Semicolon ';' seperated list of interfaces to listen on for traffic\ninterface=ens3\n\n# Host to connect to for wiseService\n#wiseHost=127.0.0.1\n\n# Log viewer access requests to a different log file\n#accessLogFile=\/opt\/arkime\/logs\/access.log\n\n# Control the log format for access requests. This uses URI % encoding.\n#accessLogFormat=:date :username %1b[1m:method%1b[0m %1b[33m:url%1b[0m :status :res[content-length] bytes :response-time ms\n\n# The directory to save raw pcap files to\npcapDir=\/opt\/arkime\/raw\n\n# The max raw pcap file size in gigabytes, with a max value of 36G.\n# The disk should have room for at least 10*maxFileSizeG\nmaxFileSizeG=12\n\n# The max time in minutes between rotating pcap files. Default is 0, which means\n# only rotate based on current file size and the maxFileSizeG variable\n#maxFileTimeM=60\n\n# TCP timeout value. Arkime writes a session record after this many seconds\n# of inactivity.\ntcpTimeout=600\n\n# Arkime writes a session record after this many seconds, no matter if\n# active or inactive\ntcpSaveTimeout=720\n\n# UDP timeout value. Arkime assumes the UDP session is ended after this\n# many seconds of inactivity.\nudpTimeout=30\n\n# ICMP timeout value. Arkime assumes the ICMP session is ended after this\n# many seconds of inactivity.\nicmpTimeout=10\n\n# An aproximiate maximum number of active sessions Arkime will try and monitor\nmaxStreams=1000000\n\n# Arkime writes a session record after this many packets\nmaxPackets=10000\n\n# Delete pcap files when free space is lower then this in gigabytes OR it can be\n# expressed as a percentage (ex: 5%). This does NOT delete the session records in\n# the database. It is recommended this value is between 5% and 10% of the disk.\n# Database deletes are done by the db.pl expire script\nfreeSpaceG=5%\n\n# The port to listen on, by default 8005\n#viewPort=8005\n\n# The host\/ip to listen on, by default 0.0.0.0 which is ALL\n#viewHost=localhost\n\n# A MaxMind account is now required, Arkime checks several install locations, or\n# will work without Geo files installed. See https:\/\/arkime.com\/faq#maxmind\n#geoLite2Country=\/var\/lib\/GeoIP\/GeoLite2-Country.mmdb;\/usr\/share\/GeoIP\/GeoLite2-Country.mmdb;\/opt\/arkime\/etc\/GeoLite2-Country.mmdb\n#geoLite2ASN=\/var\/lib\/GeoIP\/GeoLite2-ASN.mmdb;\/usr\/share\/GeoIP\/GeoLite2-ASN.mmdb;\/opt\/arkime\/etc\/GeoLite2-ASN.mmdb\n\n# Path of the rir assignments file\n#  https:\/\/www.iana.org\/assignments\/ipv4-address-space\/ipv4-address-space.csv\nrirFile=\/opt\/arkime\/etc\/ipv4-address-space.csv\n\n# Path of the OUI file from whareshark\n#  https:\/\/raw.githubusercontent.com\/wireshark\/wireshark\/master\/manuf\nouiFile=\/opt\/arkime\/etc\/oui.txt\n\n# Arkime rules to allow you specify actions to perform when criteria are met with certain fields or state. \n# See https:\/\/arkime.com\/rulesformat\n#rulesFiles=\/opt\/arkime\/etc\/arkime.rules\n\n# User to drop privileges to. The pcapDir must be writable by this user or group below\ndropUser=nobody\n\n# Group to drop privileges to. The pcapDir must be writable by this group or user above\ndropGroup=daemon\n\n# Header to use for determining the username to check in the database for instead of\n# using http digest. Use this if apache or something else is doing the auth.\n# Set viewHost to localhost or use iptables\n# Might need something like this in the httpd.conf\n# RewriteRule .* - [E=ENV_RU:%{REMOTE_USER}]\n# RequestHeader set ARKIME_USER %{ENV_RU}e\n#userNameHeader=arkime_user\n\n#\n# Headers to use to determine if user from `userNameHeader` is\n# authorized to use the system, and if so create a new user\n# in the Arkime user database. This implementation expects that\n# the users LDAP\/AD groups (or similar) are populated into an\n# HTTP header by the Apache (or similar) referenced above.\n# The JSON in userAutoCreateTmpl is used to insert the new\n# user into the arkime database (if not already present)\n# and additional HTTP headers can be sourced from the request\n# to populate various fields.\n#\n# The example below pulls verifies that an HTTP header called `UserGroup`\n# is present, and contains the value \"ARKIME_ACCESS\". If this authorization\n# check passes, the user database is inspected for the user in `userNameHeader`\n# and if it is not present it is created. The system uses the\n# `arkime_user` and `http_auth_mail` headers from the\n# request and uses them to populate `userId` and `userName`\n# fields for the new user record.\n#\n# Once the user record is created, this functionaity\n# neither updates nor deletes the data, though if the user is no longer\n# reported to be in the group, access is denied regardless of the status\n# in the arkime database.\n#\n#requiredAuthHeader=\"UserGroup\"\n#requiredAuthHeaderVal=\"ARKIME_ACCESS\"\n#userAutoCreateTmpl={\"userId\": \"${this.arkime_user}\", \"userName\": \"${this.http_auth_mail}\", \"enabled\": true, \"webEnabled\": true, \"headerAuthEnabled\": true, \"emailSearch\": true, \"createEnabled\": false, \"removeEnabled\": false, \"packetSearch\": true }\n\n# Should we parse extra smtp traffic info\nparseSMTP=true\n\n# Should we parse extra smb traffic info\nparseSMB=true\n\n# Should we parse HTTP QS Values\nparseQSValue=false\n\n# Should we calculate sha256 for bodies\nsupportSha256=false\n\n# Only index HTTP request bodies less than this number of bytes *\/\nmaxReqBody=64\n\n# Only store request bodies that Utf-8?\nconfig.reqBodyOnlyUtf8=true\n\n# Semicolon ';' seperated list of SMTP Headers that have ips, need to have the terminating colon ':'\nsmtpIpHeaders=X-Originating-IP:;X-Barracuda-Apparent-Source-IP:\n\n# Semicolon ';' seperated list of directories to load parsers from\nparsersDir=\/opt\/arkime\/parsers\n\n# Semicolon ';' seperated list of directories to load plugins from\npluginsDir=\/opt\/arkime\/plugins\n\n# Semicolon ';' seperated list of plugins to load and the order to load in\n# plugins=tagger.so; netflow.so\n\n# Plugins to load as root, usually just readers\n#rootPlugins=reader-pfring; reader-daq.so\n\n# Semicolon ';' seperated list of viewer plugins to load and the order to load in\n# viewerPlugins=wise.js\n\n# NetFlowPlugin\n# Input device id, 0 by default\n#netflowSNMPInput=1\n# Outout device id, 0 by default\n#netflowSNMPOutput=2\n# Netflow version 1,5,7 supported, 7 by default\n#netflowVersion=1\n# Semicolon ';' seperated list of netflow destinations\n#netflowDestinations=localhost:9993\n\n# Specify the max number of indices we calculate spidata for.\n# ES will blow up if we allow the spiData to search too many indices.\nspiDataMaxIndices=4\n\n# Uncomment the following to allow direct uploads. This is experimental\n#uploadCommand=\/opt\/arkime\/bin\/capture --copy -n {NODE} -r {TMPFILE} -c {CONFIG} {TAGS}\n\n# Title Template\n# _cluster_ = ES cluster name\n# _userId_  = logged in User Id\n# _userName_ = logged in User Name\n# _page_ = internal page name\n# _expression_ = current search expression if set, otherwise blank\n# _-expression_ = \" - \" + current search expression if set, otherwise blank, prior spaces removed\n# _view_ = current view if set, otherwise blank\n# _-view_ = \" - \" + current view if set, otherwise blank, prior spaces removed\n#titleTemplate=_cluster_ - _page_ _-view_ _-expression_\n\n# Number of threads processing packets\npacketThreads=2\n\n# ADVANCED - Semicolon ';' seperated list of files to load for config. Files are loaded\n# in order and can replace values set in this file or previous files.\n#includes=\n\n# ADVANCED - How is pcap written to disk\n#  simple          = use O_DIRECT if available, writes in pcapWriteSize chunks,\n#                    a file per packet thread.\n#  simple-nodirect = don't use O_DIRECT. Required for zfs and others\npcapWriteMethod=simple\n\n# ADVANCED - Buffer size when writing pcap files. Should be a multiple of the raid 5 or xfs\n# stripe size. Defaults to 256k\npcapWriteSize=262143\n\n# ADVANCED - Number of bytes to bulk index at a time\ndbBulkSize=300000\n\n# ADVANCED - Max number of connections to OpenSearch\/Elasticsearch\nmaxESConns=30\n\n# ADVANCED - Max number of es requests outstanding in q\nmaxESRequests=500\n\n# ADVANCED - Number of packets to ask libpcap to read per poll\/spin\n# Increasing may hurt stats and ES performance\n# Decreasing may cause more dropped packets\npacketsPerPoll=50000\n\n# ADVANCED - The base path for Arkime web access. Must end with a \/ or bad things will happen\n# Only set when using a reverse proxy\n# webBasePath=\/arkime\/\n\n# DEBUG - Write to stdout info every X packets.\n# Set to -1 to never log status\nlogEveryXPackets=100000\n\n# DEBUG - Write to stdout unknown protocols\nlogUnknownProtocols=false\n\n# DEBUG - Write to stdout OpenSearch\/Elasticsearch requests\nlogESRequests=true\n\n# DEBUG - Write to stdout file creation information\nlogFileCreation=true\n\n\n### High Performance settings\n# https:\/\/arkime.com\/settings#high-performance-settings\n# magicMode=basic\n# pcapReadMethod=tpacketv3\n# tpacketv3NumThreads=2\n# pcapWriteMethod=simple\n# pcapWriteSize=2560000\n# packetThreads=5\n# maxPacketsInQueue=200000\n\n### Low Bandwidth settings\n# packetThreads=1\n# pcapWriteSize=65536\n\n##############################################################################\n# override-ips is a special section that overrides the MaxMind databases for\n# the fields set, but fields not set will still use MaxMind (example if you set\n# tags but not country it will use MaxMind for the country)\n# Spaces and capitalization is very important.\n# IP Can be a single IP or a CIDR\n# Up to 10 tags can be added\n#\n# ip=tag:TAGNAME1;tag:TAGNAME2;country:3LetterUpperCaseCountry;asn:ASN STRING\n#[override-ips]\n#10.1.0.0\/16=tag:ny-office;country:USA;asn:AS0000 This is an ASN\n\n##############################################################################\n# It is possible to define in the config file extra http\/email headers\n# to index. They are accessed using the expression http.<fieldname> and\n# email.<fieldname> with optional .cnt expressions\n#\n# Possible config atributes for all headers\n#   type:<string> (string|integer|ip)  = data type                (default string)\n#  count:<boolean>                     = index count of items     (default false)\n#  unique:<boolean>                    = only record unique items (default true)\n\n# headers-http-request is used to configure request headers to index\n[headers-http-request]\nreferer=type:string;count:true;unique:true\nauthorization=type:string;count:true\ncontent-type=type:string;count:true\norigin=type:string\n\n# headers-http-response is used to configure http response headers to index\n[headers-http-response]\nlocation=type:string\nserver=type:string\ncontent-type=type:string;count:true\n\n# headers-email is used to configure email headers to index\n[headers-email]\nx-priority=type:integer\nauthorization=type:string\n\n\n##############################################################################\n# If you have multiple clusters and you want the ability to send sessions\n# from one cluster to another either manually or with the cron feature fill out\n# this section\n\n#[remote-clusters]\n#forensics=url:https:\/\/viewer1.host.domain:8005;serverSecret:password4arkime;name:Forensics Cluster\n#shortname2=url:http:\/\/viewer2.host.domain:8123;serverSecret:password4arkime;name:Testing Cluster\n\n\n# WARNING: This is an ini file with sections, most likely you don't want to put a setting here.\n#          New settings usually go near the top in the [default] section, or in [nodename] sections.\n\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Running Elasticsearch<\/h4>\n\n\n\n<p>Start and enable Elasticsearch to run on system boot;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl enable --now elasticsearch<\/code><\/pre>\n\n\n\n<p>Verify if Elasticsearch is running;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>curl http:\/\/localhost:9200<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>{\n  \"name\" : \"ubuntu22\",\n  \"cluster_name\" : \"elasticsearch\",\n  \"cluster_uuid\" : \"bc-twCeeSsSmgjYT6HlkXA\",\n  \"version\" : {\n    \"number\" : \"7.11.1\",\n    \"build_flavor\" : \"default\",\n    \"build_type\" : \"deb\",\n    \"build_hash\" : \"ff17057114c2199c9c1bbecc727003a907c0db7a\",\n    \"build_date\" : \"2021-02-15T13:44:09.394032Z\",\n    \"build_snapshot\" : false,\n    \"lucene_version\" : \"8.7.0\",\n    \"minimum_wire_compatibility_version\" : \"6.8.0\",\n    \"minimum_index_compatibility_version\" : \"6.0.0-beta1\"\n  },\n  \"tagline\" : \"You Know, for Search\"\n}\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Initialize Elasticsearch Arkime configuration<\/h4>\n\n\n\n<p>Run the command below to initialize Elasticsearch Arkime configuration.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>\/opt\/arkime\/db\/db.pl http:\/\/localhost:9200 init<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Create Arkime Admin User Account<\/h4>\n\n\n\n<p>You can use the <code><strong>\/opt\/arkime\/bin\/arkime_add_user.sh<\/strong><\/code> script to create Arkime user account;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/opt\/arkime\/bin\/arkime_add_user.sh --help<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\naddUser.js [<config options>] <user id> <user friendly name> <password> [<options>]\nOptions:\n  --admin               Has admin privileges\n  --apionly             Can only use api, not web pages\n  --email               Can do email searches\n  --expression  <expr>  Forced user expression\n  --remove              Can remove data (scrub, delete tags)\n  --webauth             Can auth using the web auth header or password\n  --webauthonly         Can auth using the web auth header only, password ignored\n  --packetSearch        Can create a packet search job (hunt)\nConfig Options:\n  -c <config file>      Config file to use\n  -n <node name>        Node name section to use in config file\n  --insecure            Allow insecure HTTPS\n<\/code><\/pre>\n\n\n\n<p>Run the command below to create Arkime admin user account. Replace the username and password accordingly.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/opt\/arkime\/bin\/arkime_add_user.sh admin \"SuperAdmin\" changeme --admin<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Running Arkime Services<\/h3>\n\n\n\n<p>Arkime is made up of 3 components:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><em><strong>capture<\/strong>&nbsp;&#8211; A threaded C application that monitors network traffic, writes PCAP formatted files to disk, parses the captured packets, and sends metadata (SPI data) to elasticsearch.<\/em><\/li>\n\n\n\n<li><em><strong>viewer<\/strong>&nbsp;&#8211; A&nbsp;node.js&nbsp;application that runs per capture machine. It handles the web interface and transfer of PCAP files.<\/em><\/li>\n\n\n\n<li><em><strong>elasticsearch<\/strong>&nbsp;&#8211; The search database technology powering Arkime.<\/em><\/li>\n<\/ul>\n\n\n\n<p>We already started Elasticsearch.<\/p>\n\n\n\n<p>Now start and enable Arkime Capture and viewer services to run on system boot;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl enable --now arkimecapture<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl enable --now arkimeviewer<\/code><\/pre>\n\n\n\n<p>Check the status;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl status arkimecapture<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\u25cf arkimecapture.service - Arkime Capture\n     Loaded: loaded (\/etc\/systemd\/system\/arkimecapture.service; enabled; vendor preset: enabled)\n     Active: active (running) since Fri 2021-11-12 21:02:08 EAT; 27s ago\n   Main PID: 4125 (sh)\n      Tasks: 2 (limit: 1133)\n     Memory: 30.2M\n        CPU: 389ms\n     CGroup: \/system.slice\/arkimecapture.service\n             \u251c\u25004125 \/bin\/sh -c \/opt\/arkime\/bin\/capture -c \/opt\/arkime\/etc\/config.ini  &gt;&gt; \/opt\/arkime\/logs\/capture.log 2&gt;&amp;1\n             \u2514\u25004126 \/opt\/arkime\/bin\/capture -c \/opt\/arkime\/etc\/config.ini\n\nNov 12 21:02:07 debian11 systemd[1]: Starting Arkime Capture...\nNov 12 21:02:08 debian11 systemd[1]: Started Arkime Capture.\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl status arkimeviewer<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\u25cf arkimeviewer.service - Arkime Viewer\n     Loaded: loaded (\/etc\/systemd\/system\/arkimeviewer.service; enabled; vendor preset: enabled)\n     Active: active (running) since Fri 2021-11-12 21:02:33 EAT; 48s ago\n   Main PID: 4147 (sh)\n      Tasks: 8 (limit: 1133)\n     Memory: 42.1M\n        CPU: 2.457s\n     CGroup: \/system.slice\/arkimeviewer.service\n             \u251c\u25004147 \/bin\/sh -c \/opt\/arkime\/bin\/node viewer.js -c \/opt\/arkime\/etc\/config.ini  &gt;&gt; \/opt\/arkime\/logs\/viewer.log 2&gt;&amp;1\n             \u2514\u25004148 \/opt\/arkime\/bin\/node viewer.js -c \/opt\/arkime\/etc\/config.ini\n\nNov 12 21:02:33 debian11 systemd[1]: Started Arkime Viewer.\n<\/code><\/pre>\n\n\n\n<p>Sometime, when you reboot your system, Elasticsearch may take some time before it starts. This thus affects the start of the Arkime capture and viewer services.<\/p>\n\n\n\n<p>We have made some few updates to both Arkime capture and viewer services such that they only start after Elasticsearch has started. Please note that with this change, you may miss the traffic capture while Elasticsearch starts.<\/p>\n\n\n\n<p>Add these lines to the Arkime capture and viewer service files;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>After=network.target elasticsearch.service\nRequires=network.target elasticsearch.service<\/code><\/pre>\n\n\n\n<p>You can use sed to update these services;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sed -i 's\/network.target\/network.target elasticsearch.service\/' \/etc\/systemd\/system\/arkimecapture.service \/etc\/systemd\/system\/arkimeviewer.service<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sed -i '\/After=\/a Requires=network.target elasticsearch.service' \/etc\/systemd\/system\/arkimecapture.service \/etc\/systemd\/system\/arkimeviewer.service<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl daemon-reload<\/code><\/pre>\n\n\n\n<p>This will ensure that Arkime capture and viewer will start only after Elasticsearch.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Log Files<\/h3>\n\n\n\n<p>You can find Arkime\/Moloch logs and Elasticsearch logs on the log files;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>\/opt\/arkime\/logs\/viewer.log<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>\/opt\/arkime\/logs\/capture.log<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>\/var\/log\/elasticsearch\/*<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Adjusting Arkime\/Moloch configurations;<\/h5>\n\n\n\n<p>if you ever want to update Arkime\/Moloch configs, check the configuration file <code><strong>\/opt\/arkime\/etc\/config.ini<\/strong><\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Accessing Arkime\/Moloch Web Interface<\/h2>\n\n\n\n<p>Moloch is listening on port 8005\/tcp by default.<\/p>\n\n\n\n<p>If UFW is running, open this port on it to allow external access.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ufw allow 8005\/tcp<\/code><\/pre>\n\n\n\n<p>You can then access Arkime\/Moloch using the URL, <code><strong>http:\/\/MOLOCHHOST:8005<\/strong><\/code> with your favorite browser.<\/p>\n\n\n\n<p>Want to enable HTTPS? See <a href=\"https:\/\/kifarunix.com\/install-arkime-moloch-full-packet-capture-tool-on-debian\/#arkime-with-ssl\" target=\"_blank\" rel=\"noreferrer noopener\">this guide<\/a>.<\/p>\n\n\n\n<p>You will be prompted to enter the basic user authentication credentials you create above.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1371\" height=\"392\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-authentication.png\" alt=\"\" class=\"wp-image-7995\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-authentication.png?v=1614108170 1371w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-authentication-768x220.png?v=1614108170 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-authentication-150x43.png?v=1614108170 150w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-authentication-300x86.png?v=1614108170 300w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-authentication-696x199.png?v=1614108170 696w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-authentication-1068x305.png?v=1614108170 1068w\" sizes=\"(max-width: 1371px) 100vw, 1371px\" \/><\/figure>\n\n\n\n<p>Upon successful authentication, you land on Arkime Web interface.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1898\" height=\"962\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-web-interface.png\" alt=\"Install Arkime (Moloch) Full Packet Capture tool on Ubuntu\" class=\"wp-image-7996\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-web-interface.png?v=1614108209 1898w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-web-interface-768x389.png?v=1614108209 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-web-interface-1536x779.png?v=1614108209 1536w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-web-interface-150x76.png?v=1614108209 150w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-web-interface-300x152.png?v=1614108209 300w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-web-interface-696x353.png?v=1614108209 696w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-web-interface-1068x541.png?v=1614108209 1068w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/arkime-moloch-web-interface-829x420.png?v=1614108209 829w\" sizes=\"(max-width: 1898px) 100vw, 1898px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1901\" height=\"959\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/moloch-spiview.png\" alt=\"\" class=\"wp-image-7997\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/moloch-spiview.png?v=1614108229 1901w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/moloch-spiview-768x387.png?v=1614108229 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/moloch-spiview-1536x775.png?v=1614108229 1536w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/moloch-spiview-150x76.png?v=1614108229 150w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/moloch-spiview-300x151.png?v=1614108229 300w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/moloch-spiview-696x351.png?v=1614108229 696w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/moloch-spiview-1068x539.png?v=1614108229 1068w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/02\/moloch-spiview-833x420.png?v=1614108229 833w\" sizes=\"(max-width: 1901px) 100vw, 1901px\" \/><\/figure>\n\n\n\n<p>Check Arkime help page by clicking on the owl at the top right!<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1886\" height=\"888\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/arkime-help-page.png\" alt=\"\" class=\"wp-image-15455\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/arkime-help-page.png?v=1675870060 1886w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/arkime-help-page-768x362.png?v=1675870060 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/arkime-help-page-1536x723.png?v=1675870060 1536w\" sizes=\"(max-width: 1886px) 100vw, 1886px\" \/><\/figure>\n\n\n\n<p>And that is how simple it is to install Arkime on Ubuntu.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Reference<\/h3>\n\n\n\n<p><a aria-label=\"Arkime Installation README (opens in a new tab)\" class=\"rank-math-link\" href=\"https:\/\/raw.githubusercontent.com\/arkime\/arkime\/master\/release\/README.txt\" target=\"_blank\" rel=\"noreferrer noopener\">Arkime Installation README.txt<\/a><\/p>\n\n\n\n<p>Arkime Demo (Credentials:&nbsp;<strong>arkime:arkime<\/strong>)<\/p>\n\n\n\n<p><a href=\"https:\/\/demo.arkime.com\/?date=-1\" target=\"_blank\" rel=\"noreferrer noopener\">Arkime Demo<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Further Reading<\/h3>\n\n\n\n<p><a aria-label=\"Arkime Settings page (opens in a new tab)\" href=\"https:\/\/arkime.com\/settings\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Arkime Settings page<\/a><\/p>\n\n\n\n<p><a aria-label=\"Arkime Faqs (opens in a new tab)\" class=\"rank-math-link\" href=\"https:\/\/arkime.com\/faq\" target=\"_blank\" rel=\"noreferrer noopener\">Arkime Faqs<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Welcome to our tutorial on how to install Arkime (Moloch) Full Packet Capture tool on Ubuntu 20.04\/Ubuntu 22.04\/Ubuntu 18.04. Arkime, formerly Moloch &#8220;is a large<\/p>\n","protected":false},"author":3,"featured_media":7994,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[72,34],"tags":[3184,3182,3180,3179,3181,3178,3183,1200],"class_list":["post-7993","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-monitoring","category-security","tag-arkime","tag-arkime-elasticsearch","tag-arkime-moloch-ubuntu-20-04","tag-install-arkime-on-ubuntu","tag-install-arkime-on-ubuntu-20-04","tag-install-moloch-on-ubuntu","tag-moloch","tag-ubuntu-20-04","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/7993"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=7993"}],"version-history":[{"count":11,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/7993\/revisions"}],"predecessor-version":[{"id":21926,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/7993\/revisions\/21926"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/7994"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=7993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=7993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=7993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}