Malcolm vs TShark

Malcolm is a network traffic analysis suite for security monitoring. It accepts PCAP files, Zeek logs, and Suricata alerts through a browser interface, and can also process live captures forwarded by lightweight sensors. OpenSearch Dashboards provides visualizations, while Arkime helps locate and identify network sessions. Malcolm adds context to session data with GeoIP, hardware manufacturer lookups, asset inventory mappings, and JA4 fingerprints. It analyzes documented protocols including DNS, HTTP, Modbus, and BACnet. Deployment uses Docker or Podman containers, with Kubernetes instructions for on-premises or AWS environments. A dedicated server requires at least 8 CPU cores and 24 GB of RAM; the developers recommend 16 or more cores and at least 32 GB for an optimal experience. The interface requires authentication, with TLS-encrypted local basic authentication, LDAP, and Keycloak options. Malcolm is self-hosted and free under the Apache License 2.0.

TShark is the Wireshark project's terminal-mode utility for capturing and analyzing network traffic. It can capture live packets or read saved captures, decode packet data for output, and write captures to a file. Its native capture format is pcapng, and it can read and write formats supported by Wireshark. Display filters use Wireshark syntax to select packets and protocol fields. Output formats include fields, JSON, PDML, and text; capture controls include interface selection, capture filters, packet limits, and ring-buffer files. TShark can write ElasticSearch mapping data or pipe packet output to another program or script. One constraint is that display filters are unavailable when capturing and saving packets with the -w option. The manual sets a 2 TB maximum capture-file size and notes potential issues above 2^32 packets. The Wireshark project is maintained by the Wireshark Foundation, a nonprofit supported by donations. TShark is free under GNU GPL version 2 and runs on Linux, macOS, and Windows.