Malcolm vs PCAPdroid

Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface, and can also process live captures forwarded by lightweight sensors. OpenSearch Dashboards provides visualizations, while Arkime helps locate and identify network sessions. Malcolm adds context to session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprints. It analyzes documented protocols including DNS, HTTP, Modbus, and BACnet. Deployment uses Docker or Podman containers, with Kubernetes instructions for on-premises or AWS environments. A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and at least 32 GB for an optimal experience. The interface requires authentication, with TLS-encrypted local basic authentication, LDAP, and Keycloak options. Malcolm is self-hosted and free under the Apache License 2.0.

PCAPdroid is an open-source Android network capture and monitoring tool that works without root privileges. It uses Android VpnService to receive app traffic, then processes it locally without creating an external VPN. Its connection view shows protocol, ports, addresses, status and traffic volume. Captures can be saved as PCAP files or sent remotely for analysis, and the app supports offline trace analysis, display filters and command-line capture. It can decrypt HTTPS/TLS traffic for a specific app, subject to Android certificate trust limitations. The free plan covers core monitoring and capture; paid features add a firewall for blocking apps, domains and IP addresses with configurable rules and allowlists, as well as malware detection using third-party blacklists and PCAPng format. PCAPdroid supports real-time PCAP-over-IP analysis with tools such as Wireshark, ntopng and tcpdump. In non-root mode it captures only outgoing connections started by the device running it, not traffic from other devices on the network. The project says it collects no information and processes traffic locally.