A-Packets vs Malcolm

A-Packets analyzes PCAP and PCAPNG captures for incident response, forensics and protocol inspection. It reconstructs HTTP sessions, maps communicating hosts and services, examines wireless artifacts, extracts files, identifies credential exposure and flags suspicious events. The hosted analyzer accepts native capture files from tools such as Wireshark and tcpdump. Public analysis costs nothing, requires no signup and accepts uploads up to 25 MB, but the resulting page is public. Private workspace plans include reports and a REST API key: Starter Workspace (monthly) is $11.99 a month, Professional (monthly) is $24.99 a month, and Advanced (monthly) is $49.99 a month. Yearly workspaces are $99 a year, $199 a year and $399 a year, respectively. One-time packs cost $14.99 as a one-time purchase, $44.99, paid once or $99.99, paid once. Subscription analyses have permanent private storage; credit-pack reports are deleted after 30 days. OnPrem supports customer-controlled storage and air-gapped deployments, but analyzes captures case by case and does not decrypt TLS payloads, capture continuously or alert.

Malcolm is a free suite for network traffic analysis and security monitoring. It accepts PCAP files, Zeek logs and Suricata alerts through a browser interface, and can also receive live traffic through lightweight forwarders. Session data can be enriched with GeoIP, hardware-vendor, asset-inventory and JA4 fingerprinting lookups. Analysts can use prebuilt OpenSearch Dashboards or search and identify sessions with Arkime. Malcolm runs in containers and supports Docker, Podman and Kubernetes deployments; a standalone Debian-based installer ISO is also available. Analysis is accessed through a browser, and the project documents host setup for Linux, macOS and Windows. Authentication options include local accounts, LDAP, TLS certificates and Keycloak. The software provides a REST API and is released under Apache License 2.0. A deployment constraint is that rootless Podman cannot capture traffic on local network interfaces, though Malcolm can accept metadata forwarded from a network sensor appliance. The installer also formats all non-removable storage without warning.