Side by side
Arkime vs Malcolm
Both stand on network packet capture software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan Open source APILinuxSelf-hosted+1
Arkime offers session search, packet inspection, and flexible packet retention without license fees. It requires an OpenSearch or Elasticsearch deployment, so teams should account for that dependency and its operation.
Visit Arkime
Free plan APILinuxMac+3
Malcolm combines trace and live-traffic analysis with session search, visualizations, and enrichment. Its resource requirements and self-managed deployment make it a better fit for teams prepared to operate dedicated infrastructure.
Visit MalcolmThe facts
| Arkime | Malcolm | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Yes | Not published |
| Runs on | API, Linux, Self-hosted, Web | API, Linux, Mac, Self-hosted, Web, Windows |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 1 |
| Maker | Not published | Not published |
| Website | arkime.com | cisagov.github.io |
| On network packet capture software | #1 of 22 | #5 of 22 |
Arkime: what it does well
- Stores full packets in standard PCAP format.
- Supports metadata-only capture with traffic selection rules.
- Exports search results as PCAP or CSV.
- Capture can scale with more machines, CPU, or disk.
- Authentication options include OIDC.
What to know first
- Requires OpenSearch or Elasticsearch for session metadata.
- Phone indicator enrichment is limited to the U.S.
- Anonymous authentication is not recommended.
Malcolm: what it does well
- Accepts PCAP files, Zeek logs, and Suricata alerts.
- Supports live capture forwarded by lightweight sensors.
- Adds GeoIP and JA4 fingerprinting to session data.
- Offers LDAP and Keycloak authentication options.
- Free under the Apache License 2.0.
What to know first
- Requires at least 8 CPU cores and 24 GB RAM.
- Requires self-hosted container deployment.
- No free cloud plan is listed.
Alternatives to Arkime Alternatives to Malcolm The whole list