Malcolm

Overview

Malcolm is a self-hosted network security monitoring suite for teams investigating traffic across a network, rather than a lightweight packet viewer for one workstation. Its strongest case is bringing session search, traffic visualizations, and enriched network context into one free package; the trade-off is substantial server capacity and container-based deployment.

Analysts can work with PCAP files, Zeek logs, and Suricata alerts through a browser interface, or receive live capture forwarded by lightweight sensors. Arkime supports finding and identifying sessions, while OpenSearch Dashboards provides visualizations. This pairing supports investigation across stored and ongoing traffic, but it also makes Malcolm a more involved choice than a stand-alone capture utility.

Key features

Stored and live traffic: Malcolm supports offline trace analysis and live capture, accepts PCAP and PCAPNG files, and can ingest Zeek logs and Suricata alerts. Teams can use existing evidence alongside sensor-forwarded traffic instead of choosing between retrospective and ongoing monitoring.

Session and protocol analysis: Arkime helps analysts find and identify sessions, and documented protocol coverage includes DNS, HTTP, Modbus, and BACnet. That breadth is useful for network security work across both familiar web traffic and operational protocols.

Context for investigations: GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprinting enrich session data. These additions can help analysts interpret traffic in relation to geography, device makers, known assets, and client fingerprints.

Connected security components: Malcolm’s documented ecosystem includes Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, Google, and Mandiant threat intelligence sources. This gives security teams several paths to connect traffic analysis with inventory and threat intelligence workflows.

Authentication and access restrictions: The interface requires authentication and supports local TLS-encrypted basic authentication, LDAP, and Keycloak. Role-based access control and Keycloak group and realm role restrictions can limit who authenticates, which matters when multiple users share a monitoring deployment.

Deployment flexibility with real infrastructure demands: Malcolm runs in Docker or Podman containers, and documentation describes Kubernetes deployment on premises or in AWS. The recommended baseline is a dedicated server with at least 8 CPU cores and 24 GB of RAM; 16 or more cores and 32 GB or more RAM are recommended for an optimal experience. That is a meaningful barrier for small teams without spare server capacity.

Pricing

Malcolm costs free under the Apache License 2.0 and is self-hosted software. There is no paid tier in the listed plan structure, so its price is attractive for teams able to supply and operate the server infrastructure themselves. The free price does not remove the practical cost of provisioning the recommended hardware and maintaining a container deployment.

Platforms

Malcolm supports Linux, Windows, macOS, a web browser, and a REST API. The recommended requirements describe Docker on recent Linux and macOS releases and Windows 10 or later. Browser access gives analysts an interface separate from the server, while the stated host requirements and container model make this a server deployment rather than a conventional desktop installation.

Who it's for

Malcolm is best suited to security teams that need to investigate network traffic over time, correlate sessions with asset or threat context, and have the resources to run a dedicated server. Its live capture, offline trace analysis, and authentication options also make it a credible fit for shared monitoring environments.

It is less suitable for someone who wants quick packet capture on a personal computer, or an organization unable to allocate server-class hardware and manage containers. Those users may benefit more from a narrower capture tool than from Malcolm’s broader monitoring stack.

Pros and cons

Pro — combines multiple investigation views: Arkime session discovery and OpenSearch visualizations cover complementary parts of traffic analysis.

Pro — adds useful network context: GeoIP, manufacturer, asset inventory, and JA4 enrichment can make session data more actionable.

Pro — free, open-source licensing: The Apache License 2.0 avoids a software subscription or license fee.

Con — requires substantial capacity: The minimum dedicated-server recommendation of 8 CPU cores and 24 GB RAM can rule it out for smaller deployments.

Con — deployment is operationally involved: Container-based operation, with Kubernetes as another documented option, is a poor match for users seeking a simple desktop tool.

Alternatives

For a wider set of packet capture choices, browse Network Packet Capture Software.

Termshark is a free option for Linux, macOS, Windows, and Android. Choose it when you prefer a narrower capture tool and can meet its requirement for tshark v1.10.2 or newer in PATH; some tshark features are not exposed.

NetworkMiner offers a free edition and GPLv2 free and open-source C# code. It may suit readers who prefer that project’s implementation and licensing, rather than Malcolm’s container-based monitoring suite.

Colasoft Capsa has a Windows free edition limited to monitoring 10 IP addresses, with a 4-hour session timeout and no WiFi connection monitoring. Pick it when those limits are acceptable; the Professional plan is $695 as a one-time purchase.

Sniffnet is free and open source under MIT or Apache-2.0 for Linux, macOS, and Windows. It is a more suitable alternative when a free desktop-oriented option is a better fit than Malcolm’s server requirements.

Arkime is free, open source, and has no paid-only features or license fees. Consider it when session search is the priority and you want Arkime without Malcolm’s larger bundled suite.

PCAPdroid offers free core monitoring and capture on Android, with paid features excluded from its free plan. Choose it when Android is the target platform and a mobile capture tool is more appropriate.

tcpdump is free BSD-licensed software for Linux, macOS, and Windows. It is a more direct choice for command-line capture; capture permissions depend on the operating system and configuration.

TShark is a free option for Linux, macOS, and Windows. Consider it when a command-line alternative to Malcolm’s browser-led monitoring workflow is preferable.

Verdict

Choose Malcolm if your security team needs a free, self-hosted suite for live and offline traffic analysis, with session discovery, visualization, enrichment, and authentication controls in the same deployment. Its main reason to look elsewhere is the infrastructure commitment: teams without a dedicated server and capacity to operate containers will be better served by a lighter capture tool.