Malcolm vs Scapy

Malcolm is a free suite for network traffic analysis and security monitoring. It accepts PCAP files, Zeek logs and Suricata alerts through a browser interface, and can also receive live traffic through lightweight forwarders. Session data can be enriched with GeoIP, hardware-vendor, asset-inventory and JA4 fingerprinting lookups. Analysts can use prebuilt OpenSearch Dashboards or search and identify sessions with Arkime. Malcolm runs in containers and supports Docker, Podman and Kubernetes deployments; a standalone Debian-based installer ISO is also available. Analysis is accessed through a browser, and the project documents host setup for Linux, macOS and Windows. Authentication options include local accounts, LDAP, TLS certificates and Keycloak. The software provides a REST API and is released under Apache License 2.0. A deployment constraint is that rootless Podman cannot capture traffic on local network interfaces, though Malcolm can accept metadata forwarded from a network sensor appliance. The installer also formats all non-removable storage without warning.

Scapy is a free Python packet manipulation program and library for forging or decoding packets, sending and capturing them, and matching requests with replies. It can run as an interactive shell or be used as a library. Listed tasks include scanning, tracerouting, probing, unit tests, attacks and network discovery. Users can set arbitrary field values and stack protocol layers rather than rely on predetermined templates; after a probe, Scapy returns full decoded packets before interpretation for further analysis. It can read and store pcap files, inject invalid frames and custom 802.11 frames, and be extended with protocols and add-ons. Scapy runs on Linux, macOS, BSD and Windows, though Windows installation requires Npcap. Optional plotting needs Matplotlib; TLS decryption and PKI operations need the cryptography package. The code, tests and tools use GPL v2, while the documentation uses CC BY-NC-SA 2.5. Documentation includes installation instructions, usage guides, troubleshooting and an API reference. The project supports only its latest master version, and critical bugs should be reported privately through GitHub’s security tab.