Malcolm vs PacketSafari
Malcolm
idaholab.github.io
PacketSafari
packetsafari.comSide by side
| Figure | Malcolm | PacketSafari |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 4 |
| Spec score · Network Packet Analyzer Software | 7.8 (#19) | 8.6 (#5) |
| API | Malcolm provides a REST API and forwards requests to Logstash, OpenSearch, NetBox and Arkime APIs. | The on-prem HTTP streaming API uses POST /api/v2/ai/agent/run with bearer authentication and supports cli, tshark, and standard modes. |
| Integrations | Components include NetBox for asset-inventory enrichment, Keycloak for identity and access management, and nginx-auth-ldap for LDAP authentication. | Security intelligence sources can include ET Open, abuse.ch SSLBL and URLhaus, and Stamus lateral-movement feeds. |
| Purpose | Malcolm is an easily deployable network traffic analysis tool suite for security monitoring. | PacketSafari investigates packet captures for root-cause, performance, and security questions and returns findings linked to packet evidence. |
Plans
PacketSafari
- Free EvaluationFree
- Dedicated Enterprise SaaSPriced on request
- Enterprise On-PremPriced on request
- Teams SaaSPriced on request
In their own words
Malcolm
Malcolm is a free suite for network traffic analysis and security monitoring. It accepts PCAP files, Zeek logs and Suricata alerts through a browser interface, and can also receive live traffic through lightweight forwarders. Session data can be enriched with GeoIP, hardware-vendor, asset-inventory and JA4 fingerprinting lookups. Analysts can use prebuilt OpenSearch Dashboards or search and identify sessions with Arkime. Malcolm runs in containers and supports Docker, Podman and Kubernetes deployments; a standalone Debian-based installer ISO is also available. Analysis is accessed through a browser, and the project documents host setup for Linux, macOS and Windows. Authentication options include local accounts, LDAP, TLS certificates and Keycloak. The software provides a REST API and is released under Apache License 2.0. A deployment constraint is that rootless Podman cannot capture traffic on local network interfaces, though Malcolm can accept metadata forwarded from a network sensor appliance. The installer also formats all non-removable storage without warning.
PacketSafari
PacketSafari has no write-up on Specifiction yet; its figures are above.