GL PacketScan vs Malcolm
GL PacketScan
gl.com
Malcolm
cisagov.github.ioSide by side
| Figure | GL PacketScan | Malcolm |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · Network Packet Capture Software | 7.4 (#11) | 7.9 (#9) |
| Integrations | PacketScan can send protocol fields, traffic summaries, and call detail records to GL’s NetSurveyorWeb centralized monitoring platform. | Its documented components include Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, Google, and Mandiant threat intelligence sources. |
| Protocol coverage | Supported protocols include 5G, LTE, IMS, SIP, RTP, SIGTRAN, GSM, UMTS, Diameter, TCP, and UDP. | Malcolm uses Zeek and Arkime to analyze traffic across documented protocols including DNS, HTTP, Modbus, and BACnet. |
| Purpose | PacketScan captures and analyzes live or recorded IPv4 and IPv6 traffic for telecom, enterprise, VoIP, wireless, and mission-critical networks. | Malcolm is a network traffic analysis tool suite for network security monitoring. |
Plans
In their own words
GL PacketScan
GL PacketScan has no write-up on Specifiction yet; its figures are above.
Malcolm
Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface, and can also process live captures forwarded by lightweight sensors. OpenSearch Dashboards provides visualizations, while Arkime helps locate and identify network sessions. Malcolm adds context to session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprints. It analyzes documented protocols including DNS, HTTP, Modbus, and BACnet. Deployment uses Docker or Podman containers, with Kubernetes instructions for on-premises or AWS environments. A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and at least 32 GB for an optimal experience. The interface requires authentication, with TLS-encrypted local basic authentication, LDAP, and Keycloak options. Malcolm is self-hosted and free under the Apache License 2.0.