For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
Mobile US PressList your app
Vendor dashboard

Malcolm

No phone app

7.9No. 4 of 20
in Network Packet Capture Software
  • Recognised40% of the score90
  • Phone app26% of the score0
  • Documented20% of the score87
  • Free plan14% of the score100
Free plan
Yes
Runs on
api, Linux, Mac, self-hosted, Web, Windows
Visit site Alternatives

Summary

Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface, or live captures forwarded by lightweight sensors. OpenSearch Dashboards provides visualizations, while Arkime helps find and identify network sessions. Malcolm adds context to session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprinting. Its documented components include Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, and Google and Mandiant threat intelligence sources. It analyzes protocols including DNS, HTTP, Modbus, and BACnet. Malcolm runs in Docker or Podman containers, with Kubernetes deployment described for on-premises environments or AWS. A dedicated server requires at least 8 CPU cores and 24 GB of RAM; 16 or more cores and 32 GB or more are recommended for an optimal experience. The interface requires authentication, with local TLS-encrypted basic authentication, LDAP, and Keycloak options. Malcolm is free under the Apache License 2.0.

Who it is for

Malcolm suits security teams that need to inspect network traffic and enrich session data. It is intended for users able to deploy and operate containerized software with substantial server resources.

What is good

  • Accepts PCAP files, Zeek logs, and Suricata alerts
  • Supports live capture forwarded by lightweight sensors
  • Combines OpenSearch Dashboards and Arkime analysis interfaces
  • Enriches sessions with GeoIP and asset mappings
  • Free under the Apache License 2.0

What to know first

  • Dedicated server requires at least 8 CPU cores and 24 GB RAM
  • Deployment uses Docker or Podman containers
  • The interface requires authentication

Verdict

Malcolm brings offline traces and forwarded live captures into a suite with visualization, session search, and enrichment. Its stated server requirements and container deployment are important considerations.

Malcolm plans and pricing

All plans
Malcolm Free Apache License 2.0 · Self-hosted software cisagov.github.io · 29 Sept 2026

Compared on network packet capture software

Free plan
Yescisagov.github.io
Live capture
Yescisagov.github.io
Offline trace analysis
Yescisagov.github.io
Display filters
Yescisagov.github.io
Capture file formats
PCAP, PCAPNGcisagov.github.io
Command-line capture
Yescisagov.github.io
Supported platforms
Linux, Windows, macOS, web browser, REST APIcisagov.github.io

Facts

Purpose
Malcolm is a network traffic analysis tool suite for network security monitoring.cisagov.github.io · 29 Sept 2026
Input data
It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface or from live capture forwarded by lightweight sensors.cisagov.github.io · 29 Sept 2026
Analysis interfaces
It provides OpenSearch Dashboards for visualizations and Arkime for finding and identifying network sessions.cisagov.github.io · 29 Sept 2026
Data enrichment
Malcolm enriches network session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprinting.cisagov.github.io · 29 Sept 2026
Integrations
Its documented components include Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, Google, and Mandiant threat intelligence sources.cisagov.github.io · 29 Sept 2026
Deployment
Malcolm runs in containers using Docker or Podman, and documentation also describes Kubernetes deployment on premises or in AWS.cisagov.github.io · 29 Sept 2026
Host platforms
The recommended requirements page says Malcolm runs on Docker on recent Linux and macOS releases and Windows 10 or later.cisagov.github.io · 29 Sept 2026
System requirements
A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and 32 GB or more RAM for an optimal experience.cisagov.github.io · 29 Sept 2026
Security
Malcolm requires authentication for its user interface and supports local TLS-encrypted basic authentication, LDAP, and Keycloak authentication.cisagov.github.io · 29 Sept 2026
Access control
The documentation describes role-based access control and Keycloak group and realm role restrictions for limiting which users can authenticate.cisagov.github.io · 29 Sept 2026
Protocol coverage
Malcolm uses Zeek and Arkime to analyze traffic across documented protocols including DNS, HTTP, Modbus, and BACnet.cisagov.github.io · 29 Sept 2026
License
The project says it is licensed under the Apache License, version 2.0.cisagov.github.io · 29 Sept 2026

Best Malcolm alternatives

See all 19
Termshark No. 1 8.2 Android onlyFreeWireshark No. 2 8.1 No phone appFreeTShark No. 3 8.0 No phone appFreePCAPdroid No. 5 7.8 Android onlyFreeArkime No. 6 7.7 No phone appFreetcpdump No. 7 7.6 No phone appFree

Where it ranks on Samsung Mobile US Press

Is Malcolm yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Malcolm

Sources