Malcolm vs nChronos
Malcolm
cisagov.github.ionChronos
colasoft.comSide by side
| Figure | Malcolm | nChronos |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Network Packet Capture Software | 7.9 (#9) | 7.4 (#12) |
| Deployment | Malcolm runs in containers using Docker or Podman, and documentation also describes Kubernetes deployment on premises or in AWS. | The product uses a client/server architecture, with server-side capture, analysis and storage and a console for viewing and analyzing server data. |
| Integrations | Its documented components include Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, Google, and Mandiant threat intelligence sources. | nChronos can replay packet files in formats including libpcap used by Wireshark, Ethereal and Tcpdump, plus several vendor packet formats. |
| Purpose | Malcolm is a network traffic analysis tool suite for network security monitoring. | nChronos is an application-centric network performance analysis system combining a server and console for continuous packet capture, storage, data mining and traffic analysis. |
| Security | Malcolm requires authentication for its user interface and supports local TLS-encrypted basic authentication, LDAP, and Keycloak authentication. | The maker says connections between nChronos Server and Console are encrypted using a private encryption algorithm. |
Plans
In their own words
Malcolm
Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface, and can also process live captures forwarded by lightweight sensors. OpenSearch Dashboards provides visualizations, while Arkime helps locate and identify network sessions. Malcolm adds context to session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprints. It analyzes documented protocols including DNS, HTTP, Modbus, and BACnet. Deployment uses Docker or Podman containers, with Kubernetes instructions for on-premises or AWS environments. A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and at least 32 GB for an optimal experience. The interface requires authentication, with TLS-encrypted local basic authentication, LDAP, and Keycloak options. Malcolm is self-hosted and free under the Apache License 2.0.
nChronos
nChronos is Colasoft’s application-focused network performance analysis system for medium and large corporate networks. Its client/server design places continuous packet capture, analysis, storage and data mining on a server, while a console displays and analyzes the collected data. The server can receive traffic through a network mirror port or link tap and retain packets for later investigation of network or application problems. Real-time statistics and user-defined alerts show network events as they occur. System or custom reports can be scheduled for hourly, daily, weekly or monthly email delivery. Users can define application and transaction monitoring, with profiles for HTTP, FTP, email and DNS. Packet files can be replayed from Colasoft, libpcap and several vendor formats, including files associated with Wireshark, Ethereal and Tcpdump. Linux server systems and Windows consoles are listed, with browser-based server configuration. Standard specifications allow four logical links, eight capture interfaces and two concurrent server connections.