Maltrail monitors network traffic for communication with malicious infrastructure and signs of suspicious activity. It helps administrators investigate network events rather than scanning local files or automatically removing malware.
A Rust sensor captures and analyses traffic, while a Python server collects events and provides a browser-based reporting interface. These components can run together or on separate machines.
This is free and open source software.
Key Features
- Match domains, URLs, IP addresses, address-and-port combinations and User-Agent values against threat indicators.
- Combine public feeds with custom indicators and configurable allowlists.
- Apply heuristics to suspicious DNS activity, scanning attempts, downloads and other network behaviour.
- Configure packet-capture filters, buffer sizes and capture workers to suit the monitored network.
- Adjust the reporting server’s listening address and port independently of packet capture.
- Explore live events through searchable tables, geographic views and saved filters.
- Search retained daily logs for an indicator during retrospective investigations.
- Record investigation status, notes and tags locally in the browser.
- Export filtered results as CSV, JSON or defanged indicators.
- Forward events to remote Maltrail servers, syslog receivers and Logstash.
- Configure HTTP webhook alerts for integration with external workflows.
- Monitor sensor availability and expose operational metrics for Prometheus.
- Cross-platform support – runs on Linux, macOS, and Windows.
Website: github.com/stamparm/maltrail
Support:
Developer: Maltrail developers
License: MIT License
Maltrail is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Network Intrusion Detection Systems | |
|---|---|
| Snort | Intrusion detection/prevention with real-time traffic analysis/packet logging |
| Suricata | High performance Network IDS, IPS and Network Security Monitoring engine |
| Zeek | (formerly Bro) Powerful network analysis framework |
| Maltrail | Lightweight malicious traffic detection system |
| Kismet | Wireless intrusion detection, wireless network and device detector, and more |
| Slips | Intrusion detection and prevention system |
| Sagan | Multi-threads, high performance log analysis engine |
| psad | Intrusion detection and log analysis with iptables |
Read our verdict in the software roundup.
| Anti-Malware Tools | |
|---|---|
| ClamAV | Antivirus engine for detecting trojans, viruses, malware and other threats |
| YARA-X | Re-incarnation of YARA |
| YARA | Pattern matching swiss knife for malware researchers |
| Maltrail | Malicious traffic detection system |
| ClamTk | Graphical frontend for ClamAV |
| LMD | Malware scanner focusing on threats faced in shared hosted environments |
| phpMussel | PHP-based anti-virus anti-trojan anti-malware solution |
| Raspirus | Lightweight signature-based malware scanner |
| FastFinder | Fast suspicious file finder |
| chkrootkit | Locally checks for signs of a rootkit |
| Unhide | Forensic tool to find hidden processes and TCP/UDP ports |
| Atomdrift Scan | Malware and supply chain scanner for software security |
| paranoya | Malware scanner using indicators of compromise and YARA rules |
| decloaker | Security tool for revealing objects concealed by malware |
| Lenspect | Lightweight security threat scanner |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.