A-Packets vs Xplico

A-Packets analyzes PCAP and PCAPNG captures for incident response, forensics and protocol inspection. It reconstructs HTTP sessions, maps communicating hosts and services, examines wireless artifacts, extracts files, identifies credential exposure and flags suspicious events. The hosted analyzer accepts native capture files from tools such as Wireshark and tcpdump. Public analysis costs nothing, requires no signup and accepts uploads up to 25 MB, but the resulting page is public. Private workspace plans include reports and a REST API key: Starter Workspace (monthly) is $11.99 a month, Professional (monthly) is $24.99 a month, and Advanced (monthly) is $49.99 a month. Yearly workspaces are $99 a year, $199 a year and $399 a year, respectively. One-time packs cost $14.99 as a one-time purchase, $44.99, paid once or $99.99, paid once. Subscription analyses have permanent private storage; credit-pack reports are deleted after 30 days. OnPrem supports customer-controlled storage and air-gapped deployments, but analyzes captures case by case and does not decrypt TLS payloads, capture continuously or alert.

Xplico is free, open-source network forensic software that extracts application data from PCAP traffic captures. It can recover email, HTTP content, VoIP calls, and FTP or TFTP data, with protocol support for HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, and IPv6. Port Independent Protocol Identification recognizes application protocols without depending on port numbers. Processing supports multithreading and realtime operation, although speed depends on flows, protocol types, and computer resources. Results can be written to files or SQLite and MySQL databases. A web interface lets concurrent users manage one or more cases, using SQLite, MySQL, or PostgreSQL as a backend. Modular capture, dissector, and dispatcher components can target files, databases, or network sockets. Downloads cover Fedora, CentOS/RHEL, and Ubuntu, alongside source code and a VirtualBox image. The free plan costs nothing; data-entry and input-file counts are unrestricted, with hard-drive size as the stated limit.