Malcolm vs PcapAI
Malcolm
idaholab.github.ioPcapAI
pcapai.comSide by side
| Figure | Malcolm | PcapAI |
|---|---|---|
| Price from | — | $9.50/mo |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 13 |
| Spec score · Network Packet Analyzer Software | 7.8 (#19) | 8.4 (#6) |
| Integrations | Components include NetBox for asset-inventory enrichment, Keycloak for identity and access management, and nginx-auth-ldap for LDAP authentication. | The maker describes use with SIEM systems, CI/CD pipelines, ticketing workflows and custom backend scripts. |
| Security | Communications between Malcolm interfaces and remote log forwarders use industry-standard encryption protocols. | The maker says transfers use TLS 1.3, files are encrypted at rest during processing, and each analysis runs in an isolated container. |
Plans
PcapAI
- Single Report$9, paid once
- Starter$19 a month
- Starter pack$35, paid once
- Pro$49 a month
- Standard pack$83, paid once
- Advanced$99 a month
- Starter (yearly)$114 a year
- Starter yearly$114 a year
- Pro pack$135, paid once
- Pro (yearly)$294 a year
In their own words
Malcolm
Malcolm is a free suite for network traffic analysis and security monitoring. It accepts PCAP files, Zeek logs and Suricata alerts through a browser interface, and can also receive live traffic through lightweight forwarders. Session data can be enriched with GeoIP, hardware-vendor, asset-inventory and JA4 fingerprinting lookups. Analysts can use prebuilt OpenSearch Dashboards or search and identify sessions with Arkime. Malcolm runs in containers and supports Docker, Podman and Kubernetes deployments; a standalone Debian-based installer ISO is also available. Analysis is accessed through a browser, and the project documents host setup for Linux, macOS and Windows. Authentication options include local accounts, LDAP, TLS certificates and Keycloak. The software provides a REST API and is released under Apache License 2.0. A deployment constraint is that rootless Podman cannot capture traffic on local network interfaces, though Malcolm can accept metadata forwarded from a network sensor appliance. The installer also formats all non-removable storage without warning.
PcapAI
PcapAI analyzes PCAP and PCAPNG network captures and creates security reports. Its machine-learning models evaluate packet context and relate findings to MITRE ATT&CK techniques. Reports are downloadable PDFs with risk scores, packet evidence, findings, and remediation steps. The service detects plaintext credentials, NTLM hashes, Kerberos tickets, and session tokens, then masks discovered credentials in reports. It also surfaces retransmissions, per-flow latency, TCP Zero Window events, and ARP conflicts. The homepage offers free uploads without an account; compressed archives are not accepted, and file-size limits vary by plan. Options include web, API, Windows, macOS, Linux, and self-hosted use. An open-source MCP Server supports local analysis with AI assistants such as Claude Desktop; the maker says packet data stays on the device. The Advanced plan includes API access, and the maker describes sending findings to Splunk, Elastic SIEM, or Microsoft Sentinel. Pricing includes a $9.00 USD one-time Single Report, monthly and annual plans, and one-time packs.