Malcolm

Malcolm is ranked #11 of 33 in network packet analyzer software on The Geeks Club. It runs on API, Linux, macOS, Self-hosted, Web, Windows.

Compared on network packet analyzer software

Free plan: Yes
Live capture: Yes
Command-line tool: Yes
Operating systems: Linux, macOS, Windows
Capture file formats: PCAP
Protocol dissectors: Yes

Best Malcolm alternatives

See all 12

7.8 NETCAP Free plan

7.2 NetworkMiner Free plan

7.1 PacketSafari Free plan

7.1 Scapy Free plan

7.1 Xplico Free plan

7.0 Arkime Free plan

Malcolm

Purpose: Malcolm is an easily deployable network traffic analysis tool suite for network security monitoring.
Input data: It accepts PCAP files, Zeek logs and Suricata alerts, which can be uploaded through a browser interface or captured live and forwarded by lightweight forwarders.
Traffic enrichment: Malcolm enriches network session data with GeoIP, MAC-vendor, asset-inventory and JA4 fingerprinting lookups.
Analysis interfaces: It provides OpenSearch Dashboards with prebuilt dashboards and Arkime for searching and identifying network sessions.
Deployment model: Malcolm runs as a cluster of containers and can also be packaged as a standalone Debian-based installer ISO.
Supported hosts: Official host-configuration documentation is provided for Linux, macOS and Windows.
Security: Communications from the user interface and remote log forwarders use industry-standard encryption protocols.
Authentication: The documentation includes local accounts, LDAP authentication, TLS certificates and Keycloak-based authentication and roles.
Integrations: Malcolm uses Arkime, OpenSearch, Logstash, Filebeat, Zeek, Suricata, Strelka, YARA, Capa, ClamAV, MISP, TAXII, NetBox, PostgreSQL, Valkey and Keycloak among other components.
API: Malcolm provides a REST API and forwards requests to Logstash, OpenSearch, NetBox and Arkime APIs.
License: Malcolm source code is released under the Apache License, Version 2.0.
Target users: The project describes use in security operations centers, smaller networks, home environments and field incident-response engagements.
Podman limitation: With rootless Podman, Malcolm cannot capture traffic on local network interfaces, although it can accept metadata forwarded from a network sensor appliance.
Installer warning: The installer has no partitioning confirmations and will partition and format all non-removable storage media without warning.

Visit site Alternatives

Where it ranks on The Geeks Club

Best Network Packet Analyzer Software in 2026#11 of 33

Is Malcolm yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Malcolm

Sources

idaholab.github.io/Malcolm/docs/· checked 30 Sept 2026
github.com/idaholab/Malcolm· checked 30 Sept 2026
idaholab.github.io/Malcolm/docs/download.html· checked 30 Sept 2026
idaholab.github.io/Malcolm/docs/quickstart.html· checked 30 Sept 2026
idaholab.github.io/Malcolm/docs/components.html· checked 30 Sept 2026
idaholab.github.io/Malcolm/docs/api.html· checked 30 Sept 2026
idaholab.github.io/Malcolm/docs/contributing-guide-code-pr· checked 1 Oct 2026
idaholab.github.io/Malcolm/· checked 1 Oct 2026
inl.gov/national-security/ics-malcolm/· checked 1 Oct 2026