Malcolm vs termshark

Malcolm is a free suite for network traffic analysis and security monitoring. It accepts PCAP files, Zeek logs and Suricata alerts through a browser interface, and can also receive live traffic through lightweight forwarders. Session data can be enriched with GeoIP, hardware-vendor, asset-inventory and JA4 fingerprinting lookups. Analysts can use prebuilt OpenSearch Dashboards or search and identify sessions with Arkime. Malcolm runs in containers and supports Docker, Podman and Kubernetes deployments; a standalone Debian-based installer ISO is also available. Analysis is accessed through a browser, and the project documents host setup for Linux, macOS and Windows. Authentication options include local accounts, LDAP, TLS certificates and Keycloak. The software provides a REST API and is released under Apache License 2.0. A deployment constraint is that rootless Podman cannot capture traffic on local network interfaces, though Malcolm can accept metadata forwarded from a network sensor appliance. The installer also formats all non-removable storage without warning.

termshark is a terminal interface for tshark, inspired by Wireshark, for inspecting packet captures and network traffic. It can read pcap files or sniff live interfaces when tshark is permitted, including on a remote machine where a capture need not be copied to a desktop. Users can apply Wireshark display filters, group conversations by protocol, and reassemble TCP and UDP streams. Packet search covers packet lists, structures and bytes, using text, regular expressions, hexadecimal input or display filters. The guide also describes importing a Wireshark column set when the configuration can be found, and transferring the current capture with Magic Wormhole. The project lists Linux, macOS, BSD variants, Android through Termux and Windows. It is free and MIT-licensed, and the project says its Go implementation builds as one executable on each platform. Packet analysis requires tshark 1.10.2 or higher in the user's PATH. The project notes that some tshark features are not yet exposed by termshark; the latest listed release is v2.4.0, dated July 11, 2022.