Malcolm

Malcolm is ranked #1 of 20 in network packet capture software on The Geeks Club. It runs on API, Linux, macOS, Self-hosted, Web, Windows. There is a free plan.

Malcolm plans and pricing

All plans

Malcolm Free Apache License 2.0 · Self-hosted software cisagov.github.io · 29 Sept 2026

Compared on network packet capture software

Free plan: Yes
Live capture: Yes
Offline trace analysis: Yes
Display filters: Yes
Capture file formats: PCAP, PCAPNG
Command-line capture: Yes
Supported platforms: Linux, Windows, macOS, web browser, REST API

Best Malcolm alternatives

See all 12

8.4 Wireshark Free plan

8.3 TShark Free plan

8.3 Arkime Free plan

7.7 Termshark Free plan

7.5 NetworkMiner Free plan

7.3 tcpdump Free plan

Malcolm

Purpose: Malcolm is a network traffic analysis tool suite for network security monitoring.
Input data: It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface or from live capture forwarded by lightweight sensors.
Analysis interfaces: It provides OpenSearch Dashboards for visualizations and Arkime for finding and identifying network sessions.
Data enrichment: Malcolm enriches network session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprinting.
Integrations: Its documented components include Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, Google, and Mandiant threat intelligence sources.
Deployment: Malcolm runs in containers using Docker or Podman, and documentation also describes Kubernetes deployment on premises or in AWS.
Host platforms: The recommended requirements page says Malcolm runs on Docker on recent Linux and macOS releases and Windows 10 or later.
System requirements: A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and 32 GB or more RAM for an optimal experience.
Security: Malcolm requires authentication for its user interface and supports local TLS-encrypted basic authentication, LDAP, and Keycloak authentication.
Access control: The documentation describes role-based access control and Keycloak group and realm role restrictions for limiting which users can authenticate.
Protocol coverage: Malcolm uses Zeek and Arkime to analyze traffic across documented protocols including DNS, HTTP, Modbus, and BACnet.
License: The project says it is licensed under the Apache License, version 2.0.
Price from: Free

Visit site Alternatives

Where it ranks on The Geeks Club

Best Network Packet Capture Software in 2026#1 of 20

Is Malcolm yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Malcolm

Sources

cisagov.github.io/Malcolm/· checked 29 Sept 2026
cisagov.github.io/Malcolm/docs/· checked 29 Sept 2026
cisagov.github.io/Malcolm/docs/components.html· checked 29 Sept 2026
cisagov.github.io/Malcolm/docs/system-requirements.html· checked 29 Sept 2026
cisagov.github.io/Malcolm/docs/authsetup.html· checked 29 Sept 2026
cisagov.github.io/Malcolm/docs/protocols.html· checked 29 Sept 2026