Skip to content
SPECIFICTION
Get listed

NETCAP

netcap.io

From €49/mo Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit netcap.io
Spec score 9.2 #2 of 32 in Network Packet Analyzer Software

What it is

NETCAP converts network packet streams into structured audit records for network analysis, security research, machine learning and forensics. Its free Core edition covers 66+ record types for protocols including TCP, UDP, HTTP, TLS, DNS and DHCP. Core captures live traffic, processes PCAP files, supports distributed collection and HTTP proxy capture, and outputs Protocol Buffers, CSV, JSON streams and Prometheus metrics. It is an open-source CLI under GPL-3.0, with platform binaries and Docker images.

Pro adds interactive graph analysis, a network activity timeline, investigation notes and more than 35 analysis modules. It can flag anomalies in decoded traffic and draft incident reports for editing; the maker says Pro analyzes captures locally without an upload step. Pro is available for macOS, Windows and Linux and includes email support. The plan is listed at $548 a month, with a €48/year option also shown, and a 14-day trial without a credit card. Enterprise has custom pricing and includes unlimited team seats, priority support with an SLA, custom integrations and volume licensing.

Spec sheet

What it does
NETCAP converts live network traffic or PCAP files into structured, type-safe audit records for security research, forensics, monitoring and machine-learning workflows.Read 14 Oct 2026 · netcap.io
Purpose
NETCAP converts network packet streams into structured audit records for network analysis, security research, machine learning, and forensics.Read 2 Oct 2026 · netcap.io
API
The project exposes a Go Writer API for writing Protocol Buffer and CSV audit records, including headers and buffered channels.Read 14 Oct 2026 · netcap.io
Integrations
Pro lists handoffs or integrations with Wireshark, Metasploit, hashcat, John, and BetterCrack; Core includes a Maltego transformation plugin.Read 2 Oct 2026 · netcap.io
Security
The download page says Pro analyzes captures locally on the user's machine and has no upload step.Read 2 Oct 2026 · netcap.io
Support
Pro includes email support, Enterprise offers priority support with an SLA, and Core lists community support.Read 2 Oct 2026 · netcap.io
License
Core is GPL-3.0 copyleft; the maker also offers a separately negotiated commercial license for proprietary products.Read 14 Oct 2026 · netcap.io
Headquarters
Amsterdam, NetherlandsRead 28 Sep 2026 · netcap.io
AI features
Pro flags anomalies in decoded traffic and drafts incident reports that users can edit before export.Read 2 Oct 2026 · netcap.io
Capture
Core captures live network traffic or processes PCAP files, and supports distributed collection and HTTP proxy capture.Read 2 Oct 2026 · netcap.io
Container availability
Docker Hub provides Alpine and Ubuntu Netcap images; the listed image size is 157.3 MB and the repository was updated three months before the page crawl.Read 14 Oct 2026 · hub.docker.com
Core architecture
The Core command-line framework is implemented in Go and uses concurrent multi-core packet processing.Read 14 Oct 2026 · netcap.io
Distributed collection
The framework provides agent and collector components for distributed sensor deployments.Read 14 Oct 2026 · docs.netcap.io
Documentation depth
Documentation includes overview, quickstart, installation, configuration, packet collection, specification, rules, tests, FAQ and API-oriented examples.Read 14 Oct 2026 · docs.netcap.io
HTTP proxy
The proxy component captures web-service traffic through an HTTP reverse proxy, including IPv6 traffic that raw-packet stream reassembly could miss.Read 14 Oct 2026 · netcap.io
Independent feature inventory
The GitHub README describes 83 packet decoders, more than 40 stream decoders, 141+ audit-record types and a built-in React web UI.Read 14 Oct 2026 · github.com
Independent project activity
The public GitHub repository shows about 1.8k stars, 168 forks, GPL-3.0 licensing and a v0.9.0 release dated April 9, 2026.Read 14 Oct 2026 · github.com
Integrated tools
The single binary includes capture, dump, label, collect, agent, proxy, util, export and transform tools.Read 14 Oct 2026 · netcap.io
Investigation features
Pro includes interactive graph analysis, a network activity timeline, investigation notes, and more than 35 analysis modules.Read 2 Oct 2026 · netcap.io
License limitation
The documentation warns that the research project was not developed or tested for production, may contain undiscovered bugs and can panic on errors.Read 14 Oct 2026 · docs.netcap.io
Limit: deployment complexity
Independent technical notes say Hyperscan acceleration requires libhs through pkg-config, which complicates cross-platform CI/CD.Read 14 Oct 2026 · dev.co
Limit: detection tuning
Independent technical notes say JA4 fingerprinting and YARA rules require tuning against a traffic baseline to reduce false positives.Read 14 Oct 2026 · dev.co
Limit: resource use
Independent technical notes caution that stream reassembly and file extraction can consume substantial memory on large PCAPs or sustained traffic.Read 14 Oct 2026 · dev.co
Live capture
NETCAP captures traffic directly from network interfaces and can process saved PCAP or PCAPNG files.Read 14 Oct 2026 · docs.netcap.io
Live demo
A browser-based Pro demo runs against preloaded example captures without requiring installation.Read 14 Oct 2026 · netcap.io
Local desktop availability
The download page lists macOS 14 or later, Windows 10/11 64-bit, and Debian or Ubuntu amd64 builds for Pro.Read 2 Oct 2026 · netcap.io
Local processing
The download page says the Pro macOS application runs against local captures without an upload step.Read 14 Oct 2026 · netcap.io
Output formats
NETCAP writes compressed Protocol Buffer records and can export CSV, JSON streams and Prometheus metrics.Read 14 Oct 2026 · netcap.io
Platform support
Pro is offered for macOS, Windows, and Linux, while Core provides binaries for those platforms and Docker images.Read 2 Oct 2026 · netcap.io
Praise: developer interoperability
Independent documentation highlights Protocol Buffer output, CSV export and cross-language access to structured records.Read 14 Oct 2026 · researchgate.net
Praise: protocol breadth
Independent technical coverage describes 83 packet decoders, more than 40 stream decoders, industrial protocols and configurable TCP/UDP reassembly.Read 14 Oct 2026 · dev.co
Pro desktop application
NETCAP Pro is a desktop investigation workspace with graph exploration, timelines, analyst notes and AI-assisted triage.Read 14 Oct 2026 · netcap.io
Pro integrations
The Pro page lists hand-offs to Wireshark and Metasploit plus credential cracking integrations with hashcat, John and BetterCrack.Read 14 Oct 2026 · netcap.io
Protocol coverage
The official Core page lists more than 66 audit-record types covering protocols such as TCP, UDP, HTTP, TLS, DNS and DHCP.Read 14 Oct 2026 · netcap.io
Protocol extensibility
Developers can add layer or custom encoders, including application protocols requiring stream reassembly.Read 14 Oct 2026 · docs.netcap.io
Release history
The official blog lists releases v0.3.9, v0.4 and v0.5, with v0.4 adding HTTP proxy capture, Prometheus export and the Writer API.Read 14 Oct 2026 · netcap.io
Research origin
ResearchGate identifies the project as part of Philipp Mieden’s 2018 bachelor-thesis work on secure and scalable anomaly-based intrusion detection.Read 14 Oct 2026 · researchgate.net
Rules engine
The rules engine uses expr-lang expressions, supports MITRE ATT&CK mapping, deduplication, rate limits, severity levels and custom tags.Read 14 Oct 2026 · docs.netcap.io
Security design
NETCAP emphasizes memory-safe parsing through Go garbage collection when handling potentially malicious network input.Read 14 Oct 2026 · netcap.io
Self-hosting
Core can be built from source, installed as precompiled binaries, or run from Alpine and Ubuntu Docker images.Read 14 Oct 2026 · netcap.io
System requirements
Current downloads list macOS 14 or newer for Apple Silicon and Intel, Windows 10/11 64-bit, and Debian or Ubuntu amd64.Read 14 Oct 2026 · netcap.io
Trial and billing
The maker advertises a 14-day Pro trial without a credit card and says subscriptions can be canceled at any time with access through the billing period.Read 2 Oct 2026 · netcap.io
Unknown traffic handling
Undecoded protocols are written to unknown.pcap, while malformed-packet decoding errors are recorded in errors.log and errors.pcap.Read 14 Oct 2026 · docs.netcap.io

Plans and prices

Core Free Free forever 66+ audit record types · Protocol Buffers and CSV export · live capture and PCAP analysis · Prometheus metrics · Maltego integration · distributed collection Read 14 Oct 2026 · netcap.io
Pro €49 a month €49/month Cross-platform desktop app · graph analysis · AI threat detection · timeline analysis · tool integrations · investigation notes · session export/loading · email support · 1 seat Read 14 Oct 2026 · netcap.io
Enterprise Priced on request Custom pricing Unlimited team seats · priority SLA support · custom integrations · on-site training · dedicated account manager · custom feature development · security audit assistance · volume licensing Read 14 Oct 2026 · netcap.io

Every NETCAP plan and price →

Strong points and limits

Strong points

  • Core covers 66+ audit record types
  • Processes PCAP files and captures live traffic
  • Outputs four listed data formats
  • Core is open-source under GPL-3.0
  • Pro includes local analysis without an upload step

Limits

  • Pro is listed at $548 a month
  • Enterprise pricing is custom
  • Pro desktop builds require macOS 14 or later, Windows 10/11, or Debian/Ubuntu amd64

Who it suits

NETCAP suits network analysts, security researchers and forensic investigators who work with live traffic or PCAP files. Core may fit users seeking an open-source command-line tool; Pro adds visual investigation features.

NETCAP in depth

Read the full write-up

Overview

NETCAP is a packet-capture and analysis tool that turns network traffic into structured audit records. It is best suited to analysts and security teams who want to process live traffic or PCAP files and carry the resulting records into further analysis. Core is a capable free CLI; Pro adds investigation tools, but its one-seat subscription is a significant step up.

Key features

Core captures live traffic and processes PCAP files, with distributed collection and HTTP proxy capture for workflows that extend beyond a single saved capture. It produces 66+ audit record types across protocols including TCP, UDP, HTTP, TLS, DNS, and DHCP. The protocol breadth and structured records make it a better fit for analysis pipelines than for readers who only need to inspect packets.

Output options span Protocol Buffers, CSV, JSON streams, and Prometheus metrics, so records can feed different downstream workflows. Core also includes a Maltego transformation plugin. Pro adds handoffs or integrations with Wireshark, Metasploit, hashcat, John, and BetterCrack, along with interactive graph analysis, a network activity timeline, investigation notes, and more than 35 analysis modules. That richer investigation layer matters when an analyst needs to connect activity and preserve context, rather than just decode traffic.

Pro also flags anomalies in decoded traffic and drafts incident reports that users can edit before export. Its capture analysis runs locally on the user's machine with no upload step, a meaningful fit for sensitive captures. Core is GPL-3.0; proprietary use requires a commercial license with negotiable terms.

Pricing

Core is free forever and includes the open-source CLI, 66+ audit record types, and community support. It is the sensible starting point for individual users and teams comfortable working from the command line; it gives up Pro's investigation interface and analysis modules.

Pro costs $548 a month and includes one seat, email support, and a 14-day free trial. The pricing also shows a billed €48/year option. The trial requires no credit card, and subscriptions can be canceled at any time while access continues through the billing period. Pro suits a single analyst who needs the investigation and AI features; the one-seat allowance does not fit a team that needs multiple individual accounts.

Enterprise has custom pricing and includes unlimited team seats, priority support with an SLA, custom integrations, and volume licensing. It fits organizations that need team-wide access or tailored integrations. Core lists community support, while Pro includes email support.

Platforms

Core provides binaries for macOS, Windows, and Linux, as well as Docker images; Pro is offered on macOS, Windows, and Linux. The Pro desktop builds require macOS 14 or later, Windows 10/11 64-bit, or Debian or Ubuntu amd64. Self-hosted and web are also identified as platforms, making NETCAP relevant to both local and hosted deployment workflows.

Who it's for

NETCAP suits security researchers, network analysts, and forensic teams that need to turn traffic into structured records and then investigate it. Core is particularly well matched to users who can build their own CLI-based workflow from free, open-source software. Pro is more compelling for a single analyst who values graph-based investigation, a timeline, notes, and anomaly-assisted reporting. It is less suitable when the priority is a low-cost multi-seat investigation product.

Pros and cons

Pro: Core combines live and PCAP capture with distributed collection and HTTP proxy capture, supporting several ways to bring traffic into analysis.

Pro: More than 66 record types and four output formats give Core practical breadth for downstream analysis and monitoring.

Pro: Pro keeps capture analysis local, avoiding an upload step for sensitive traffic.

Con: Pro includes only one seat, limiting its fit for teams that need separate user accounts.

Con: Core is a CLI, while the interactive investigation tools and AI features require Pro.

Con: The stated Pro subscription is $548 a month, a substantial commitment for users who only need capture and structured output.

Alternatives

NETCAP sits among tools covered in Network Packet Analyzer Software and Network Protocol Analyzers. Consider PacketSafari as another freemium option if you want to compare a tool with broad platform coverage. Scapy is a free GPLv2 alternative for readers working with Python 3.7+.

NetworkMiner is a free and freemium option with GPLv2 source written in managed C# on.NET Framework. Colasoft Capsa is worth considering if a Windows tool with a free edition limited to 10 monitored IP addresses and four-hour sessions fits the job; its Professional plan is a 695.00 USD one-time purchase. Malcolm is another free option with broad platform coverage.

Sniffnet suits readers seeking a free, open-source option under MIT or Apache-2.0. Xplico is a free alternative with no input-file or data-entry count limit, where hard-drive size is the stated constraint. Zui is free to download and use.

Verdict

Choose NETCAP if you need a free CLI that converts live or saved network traffic into structured records, or if a single analyst needs Pro's deeper investigation and reporting tools. The main reason to look elsewhere is Pro's one-seat limit and high stated monthly price; teams needing multiple seats should weigh Enterprise's custom pricing, while users who only need packet capture can start with Core.

Verdict

NETCAP offers a free CLI for capture and structured records, with Pro adding investigation tools and analysis modules. Check the listed Pro pricing and platform requirements against your environment.

Where Specifiction places it

Alternatives to NETCAPAll alternatives →