Malcolm

Overview

Malcolm is a self-hosted suite for examining network traffic as part of security monitoring. It is best suited to teams that need to investigate stored captures and live feeds in one place. The breadth of its analysis is compelling, but the server resources and container operations make it a substantial deployment rather than a quick packet-inspection tool.

Key features

• Stored and live traffic analysis: Analysts can submit PCAP files, Zeek logs, and Suricata alerts through a browser interface, or forward live capture from lightweight sensors. Support for PCAP and PCAPNG, offline trace analysis, display filters, and command-line capture covers several ways of collecting and reviewing traffic.
• Session search and visualization: Arkime supports finding and identifying network sessions, while OpenSearch Dashboards provides visualizations. That pairing suits investigations that move between a broad view of traffic and specific sessions, rather than capture alone.
• Enriched network context: GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprinting add context to session data. These enrichments can help teams relate traffic to devices and fingerprints, though the suite's value depends on having the capacity and operational commitment to run it.
• Protocol and security ecosystem: Zeek and Arkime analyze documented protocols including DNS, HTTP, Modbus, and BACnet. Documented components also include Suricata, OpenSearch, NetBox, MISP, TAXII, Google, and Mandiant threat intelligence sources, making Malcolm a fit for teams working across network, asset, and threat-intelligence context.
• Access controls: The interface requires authentication, with local TLS-encrypted basic authentication, LDAP, and Keycloak supported. Role-based access control and Keycloak group and realm role restrictions provide ways to limit access in a shared deployment.
• Container deployment: Malcolm runs with Docker or Podman; its documentation also describes Kubernetes deployments on premises or in AWS. This flexibility benefits teams with container infrastructure, but adds deployment overhead for users seeking a standalone desktop utility.

Pricing

Malcolm is free: its plan costs nothing and is self-hosted software under the Apache License 2.0. There are no paid tiers to trade against a lower-cost plan, but free software does not remove the infrastructure burden. A dedicated server needs at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and 32 GB or more RAM for an optimal experience.

Platforms

Malcolm supports Linux, Windows, and macOS hosts, as well as a web browser and REST API. The recommended requirements say Docker runs on recent Linux and macOS releases and Windows 10 or later. The container-based setup and dedicated-server requirements matter more than the platform list for anyone deciding whether an existing machine can support it.

Who it's for

Malcolm is a strong fit for security teams that need both offline trace analysis and live capture, and can provide the server resources and container environment it requires. Its protocol coverage, session search, enrichment, and authentication options make it suited to ongoing monitoring and investigation. It is a poor choice for an individual who wants lightweight, immediate packet inspection without operating a server.

Pros and cons

• Pro: Combines file-based and sensor-forwarded live analysis, so teams can investigate stored evidence alongside ongoing traffic.
• Pro: Session search, visualizations, and enrichment give analysts more than raw capture review.
• Pro: Authentication choices and role-based restrictions support controlled access in a shared environment.
• Con: A dedicated server requires at least 8 CPU cores and 24 GB of RAM, which rules out many modest deployments.
• Con: Docker or Podman deployment, with Kubernetes also documented, demands container and infrastructure capacity that lighter capture tools do not require.

Alternatives

For a different approach to network packet capture, browse Network Packet Capture Software.

• Termshark is a free option for Linux, macOS, Windows, and Android, but it requires tshark in PATH and does not expose some tshark features.
• NetworkMiner is a freemium alternative with Linux, macOS, and Windows support; its source is managed C# on .NET Framework and released under GPLv2.
• Sniffnet is a fully free, open-source option for Linux, macOS, and Windows under MIT or Apache-2.0.
• tcpdump is a free BSD-licensed choice for Linux, macOS, and Windows; capture permission depends on the operating system and configuration.
• TShark is a free option for Linux, macOS, and Windows, maintained as part of the Wireshark project by the Wireshark Foundation.
• Wireshark is a free full-version choice for Linux, macOS, and Windows, with no license fee.
• Arkime is free, open-source self-hosted software with web and API support; it is also the session-search component Malcolm uses.
• PCAPdroid is an Android freemium alternative: its free plan covers core monitoring and capture, while paid features are a one-time purchase.

Verdict

Choose Malcolm if your security team needs a self-hosted platform for live and offline network analysis, session discovery, and enriched context, and can support its server and container requirements. Its integrated analysis capabilities are the reason to choose it; if you need lightweight capture on a desktop or phone, a narrower alternative is a better fit.