Malcolm vs Sniffnet
Malcolm
cisagov.github.ioSniffnet
sniffnet.appSide by side
| Figure | Malcolm | Sniffnet |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 1 | 2 |
| Spec score · Network Packet Capture Software | 7.9 (#9) | 8.2 (#5) |
| Integrations | Its documented components include Zeek, Suricata, Arkime, OpenSearch, NetBox, MISP, TAXII, Google, and Mandiant threat intelligence sources. | The webhook documentation gives SIGNL4, IFTTT, Svix and Webhook.site as compatible notification receivers. |
| Purpose | Malcolm is a network traffic analysis tool suite for network security monitoring. | Sniffnet is a network monitoring app for keeping track of Internet traffic, checking bandwidth usage, and inspecting network activity. |
| Security | Malcolm requires authentication for its user interface and supports local TLS-encrypted basic authentication, LDAP, and Keycloak authentication. | A 2025 security audit covered static analysis, dependency checking, code analysis and fuzzing, dynamic analysis on most supported platforms, and interactive testing; its only relevant finding was low severity and had been fixed. |
Plans
In their own words
Malcolm
Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface, and can also process live captures forwarded by lightweight sensors. OpenSearch Dashboards provides visualizations, while Arkime helps locate and identify network sessions. Malcolm adds context to session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprints. It analyzes documented protocols including DNS, HTTP, Modbus, and BACnet. Deployment uses Docker or Podman containers, with Kubernetes instructions for on-premises or AWS environments. A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and at least 32 GB for an optimal experience. The interface requires authentication, with TLS-encrypted local basic authentication, LDAP, and Keycloak options. Malcolm is self-hosted and free under the Apache License 2.0.
Sniffnet
Sniffnet is a free network monitoring app for Linux, macOS, and Windows. It displays overall internet traffic statistics and real-time charts, and can show which programs use bandwidth. Users can choose a network adapter, filter observed traffic, and import or export PCAP capture reports. Sniffnet identifies local network connections, shows remote hosts’ geographical locations, and finds host domain names and ASNs. It recognizes more than 6,000 upper-layer services, protocols, trojans, and worms. Users can configure notifications for network events and import custom IP blacklists to highlight potentially dangerous connections. The app supports live capture, display filters, protocol dissectors, and offline trace analysis; it reads PCAPNG and CAP files as well as PCAP. Custom themes and 26 languages are available. The listed Sniffnet plan is free and the software is open-source under MIT or Apache-2.0. A 2025 security audit reported one low-severity finding, which had been fixed. Most functionality uses offline databases, while reverse DNS lookups provide hostnames for IP addresses.