Airtool Pi vs Malcolm

Airtool Pi is an iPhone and iPad utility for remote Wi-Fi packet capture. It connects over SSH to Linux-based sensors or Linux endpoints with compatible adapters, starts a capture using selected settings, and saves a PcapNG file locally. Sensors can be added manually or automatically, including WLAN Pi and Oscium Nomad; version history also names WLAN Pi Go and Hamina Clip, and a Raspberry Pi can serve as a sensor. Capture controls include wireless interface, frequency band, channel, channel width, size limits, and an option to discard data-frame payloads. The App Store listing states support for 2.4, 5, and 6 GHz bands and widths from 20 to 320 MHz. Compatible adapters allow simultaneous capture on up to four channels. Files can be shared with Wireshark or another protocol analyzer. Airtool Pi costs $14.99 USD once and requires iOS or iPadOS 18.6 or later.

Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface, and can also process live captures forwarded by lightweight sensors. OpenSearch Dashboards provides visualizations, while Arkime helps locate and identify network sessions. Malcolm adds context to session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprints. It analyzes documented protocols including DNS, HTTP, Modbus, and BACnet. Deployment uses Docker or Podman containers, with Kubernetes instructions for on-premises or AWS environments. A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and at least 32 GB for an optimal experience. The interface requires authentication, with TLS-encrypted local basic authentication, LDAP, and Keycloak options. Malcolm is self-hosted and free under the Apache License 2.0.