Arkime (formerly Moloch) captures all raw network packets and indexes them via Elasticsearch, allowing investigators to retroactively search traffic that occurred months earlier — a powerful complement to IDS tools like Suricata/Zeek, which log alerts rather than raw packets.