Welcome to this tutorial on how to install Arkime (Moloch) Full Packet Capture tool on Ubuntu. Arkime, formerly Moloch “is a large scale, open source, indexed packet capture and search system“.

Here is a link to Github repository page, this page covers the features of Arkime tool include;

• It stores and indexes network traffic in standard PCAP format, providing fast, indexed access.
• Provides an intuitive web interface for PCAP browsing, searching, and exporting.
• Exposes APIs which allow for PCAP data and JSON formatted session data to be downloaded and consumed directly.
• Stores and exports all packets in standard PCAP format, allowing you to also use your favorite PCAP ingesting tools, such as wireshark, during your analysis workflow.

Install Arkime (Moloch) Full Packet Capture tool on Ubuntu (Pre-built Deb Package)
This guide will not cover how to install ubuntu, this guide is for those who already have a properly resourced Ubuntu server running. For my situation, I am running mine on Ubuntu 20.04 LTS

My Current System Specs

• 8 CPUs
• 32GB RAM
• 1TB Hard Disk

You can either install Arkime (Moloch) Full Packet Capture tool on Ubuntu using prebuilt binary packages or simply build it from the source yourself.

Installing Arkime using Prebuilt Binary on Ubuntu

Download Arkime Binary Installer

In order to install Arkime using the prebuilt binary on Ubuntu, navigate to the downloads page and grab the binary installer for your Ubuntu flavour, which in my setup is Ubuntu 20.04.

You can as well grab the link to the binary installer and pull it using curl or wget command. For example, the command below downloads the current stable release version of Arkime binary installer for Ubuntu 20.04;

wget https://s3.amazonaws.com/files.molo.ch/builds/ubuntu-20.04/arkime_3.4.2-1_amd64.deb

Run System Update

Before you begin installation, make sure your system is completely up to date;

apt update

Install Arkime (Moloch) Full Packet Capture tool on Ubuntu

Next, install Arkime (Moloch) Full Packet Capture tool on Ubuntu using the downloaded binary installer.

sudo apt install ./arkime_3.4.2-1_amd64.deb

If you want, you can as well build Arkime by building it from the source. Check the installation page for instructions.

Install Elasticsearch on Ubuntu

Arkime uses Elasticsearch as a search and indexing engine. Therefore, install Elasticsearch by running the command below;

Import the Elastic stack PGP repository signing Key

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch --no-check-certificate | sudo apt-key add -

Install Elasticsearch APT repository;

echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list

Update package cache and install Elasticsearch;

apt update

apt install elasticsearch

Configure Elasticsearch JVM options depending on the size of your memory;

nano or vim /etc/elasticsearch/jvm.options

################################################################
## IMPORTANT: JVM heap size
################################################################
##
## The heap size is automatically configured by Elasticsearch
## based on the available memory in your system and the roles
## each node is configured to fulfill. If specifying heap is
## required, it should be done through a file in jvm.options.d,
## and the min and max should be set to the same value. For
## example, to set the heap to 4 GB, create a new file in the
## jvm.options.d directory containing these lines:
##
-Xms6g
-Xmx6g
##
## See https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html
## for more information
##
################################################################

################################################################

Save and exit the config file.

You do not want to exceed more than 50% of the system RAM. I went with 6G because it is specifically to my system and more than enough for just me as a single user!!

Read More Here!

Once the installation is done, run the script below to configure Arkime (Moloch);

/opt/arkime/bin/Configure

Running Elasticsearch

Start and enable Elasticsearch to run on system boot;

systemctl enable --now elasticsearch

Verify if Elasticsearch is running;

curl https://localhost:9200

{
"name" : "pbaj-moloch",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "fBL9QXX9Q6uiDoIwqkGxng",
"version" : {
"number" : "7.17.4",
"build_flavor" : "default",
"build_type" : "deb",
"build_hash" : "79878662c54c886ae89206c685d9f1051a9d6411",
"build_date" : "2022-05-18T18:04:20.964345128Z",
"build_snapshot" : false,
"lucene_version" : "8.11.1",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}

Run the command below to initialize Elasticsearch Arkime/Moloch configuration.

/opt/arkime/db/db.pl https://localhost:9200 init

You can use the /data/moloch/bin/moloch_add_user.sh script to create Arkime/Moloch user account;

/opt/arkime/bin/arkime_add_user.sh admin "Admin User" THEPASSWORD --admin

Running Arkime Services

Arkime is made up of 3 components:

Log Files

You can find Arkime/Moloch logs and Elasticsearch logs on the log files;

/opt/arkime/logs/viewer.log

/opt/arkime/logs/capture.log

/var/log/elasticsearch/*

Adjusting Arkime/Moloch configurations;

if you ever want to update Arkime/Moloch configs, check the configuration file /opt/arkime/etc/config.ini.

Accessing Arkime/Moloch Web Interface

Moloch is listening on port 8005/tcp by default.

If UFW is running, open this port on it to allow external access.

ufw allow 8005/tcp

You can then access Arkime/Moloch using the URL, https://MOLOCHHOST:8005 with your favorite browser.

You will be prompted to enter the basic user authentication credentials you create above.

This is my Arkime Instance

Upon successful authentication, you land on Arkime Web interface.

Connections

Packet Details

And that is how simple it is to install Arkime (Moloch) Full Packet Capture tool on Ubuntu.

Arkime Installation README.txt

Further Reading

Arkime Settings page

Arkime Faqs

Finished (Unless you want NGINX with HTTPS, and hardening the firewall)

At this time, you do not have to go any further unless you want to. I preferred to limit access to my box via ufw firewall, which is simple to set up, and to have it connect via HTTPs. I am just not a fan of insecure protocols, however, this is at home and it is for personal use. I do not recommend keeping it as it is, and if you wish to add a little security, then continue proceed to Securing Arkime Server on Ubuntu 20.04.4 LTS