Malcolm vs NETCAP
Malcolm
idaholab.github.io
NETCAP
netcap.ioSide by side
| Figure | Malcolm | NETCAP |
|---|---|---|
| Price from | — | €49/mo |
| Free plan | — | Yes |
| Free trial | — | Yes |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 3 |
| Spec score · Network Packet Analyzer Software | 7.8 (#19) | 9.2 (#2) |
| API | Malcolm provides a REST API and forwards requests to Logstash, OpenSearch, NetBox and Arkime APIs. | The project exposes a Go Writer API for writing Protocol Buffer and CSV audit records, including headers and buffered channels. |
| Integrations | Components include NetBox for asset-inventory enrichment, Keycloak for identity and access management, and nginx-auth-ldap for LDAP authentication. | Pro lists handoffs or integrations with Wireshark, Metasploit, hashcat, John, and BetterCrack; Core includes a Maltego transformation plugin. |
| License | Malcolm source code is released under the Apache License, version 2.0. | Core is GPL-3.0 copyleft; the maker also offers a separately negotiated commercial license for proprietary products. |
| Purpose | Malcolm is an easily deployable network traffic analysis tool suite for security monitoring. | NETCAP converts network packet streams into structured audit records for network analysis, security research, machine learning, and forensics. |
| Security | Communications between Malcolm interfaces and remote log forwarders use industry-standard encryption protocols. | The download page says Pro analyzes captures locally on the user's machine and has no upload step. |
Plans
In their own words
Malcolm
Malcolm is a free suite for network traffic analysis and security monitoring. It accepts PCAP files, Zeek logs and Suricata alerts through a browser interface, and can also receive live traffic through lightweight forwarders. Session data can be enriched with GeoIP, hardware-vendor, asset-inventory and JA4 fingerprinting lookups. Analysts can use prebuilt OpenSearch Dashboards or search and identify sessions with Arkime. Malcolm runs in containers and supports Docker, Podman and Kubernetes deployments; a standalone Debian-based installer ISO is also available. Analysis is accessed through a browser, and the project documents host setup for Linux, macOS and Windows. Authentication options include local accounts, LDAP, TLS certificates and Keycloak. The software provides a REST API and is released under Apache License 2.0. A deployment constraint is that rootless Podman cannot capture traffic on local network interfaces, though Malcolm can accept metadata forwarded from a network sensor appliance. The installer also formats all non-removable storage without warning.
NETCAP
NETCAP converts network packet streams into structured audit records for network analysis, security research, machine learning and forensics. Its free Core edition covers 66+ record types for protocols including TCP, UDP, HTTP, TLS, DNS and DHCP. Core captures live traffic, processes PCAP files, supports distributed collection and HTTP proxy capture, and outputs Protocol Buffers, CSV, JSON streams and Prometheus metrics. It is an open-source CLI under GPL-3.0, with platform binaries and Docker images.
Pro adds interactive graph analysis, a network activity timeline, investigation notes and more than 35 analysis modules. It can flag anomalies in decoded traffic and draft incident reports for editing; the maker says Pro analyzes captures locally without an upload step. Pro is available for macOS, Windows and Linux and includes email support. The plan is listed at $548 a month, with a €48/year option also shown, and a 14-day trial without a credit card. Enterprise has custom pricing and includes unlimited team seats, priority support with an SLA, custom integrations and volume licensing.