Airtool Pi vs NetworkMiner

Airtool Pi is an iPhone and iPad utility for remote Wi-Fi packet capture. It connects over SSH to Linux-based sensors or Linux endpoints with compatible adapters, starts a capture using selected settings, and saves a PcapNG file locally. Sensors can be added manually or automatically, including WLAN Pi and Oscium Nomad; version history also names WLAN Pi Go and Hamina Clip, and a Raspberry Pi can serve as a sensor. Capture controls include wireless interface, frequency band, channel, channel width, size limits, and an option to discard data-frame payloads. The App Store listing states support for 2.4, 5, and 6 GHz bands and widths from 20 to 320 MHz. Compatible adapters allow simultaneous capture on up to four channels. Files can be shared with Wireshark or another protocol analyzer. Airtool Pi costs $14.99 USD once and requires iOS or iPadOS 18.6 or later.

NetworkMiner analyzes captured network traffic and can sniff live traffic, extracting artifacts such as files, images, emails, and passwords from PCAP files. It also builds a host inventory from IP address information for passive asset discovery and communication overviews. The free edition supports live sniffing and PCAP and ETL parsing on Windows and Linux, but not PcapNG parsing. Professional accepts PcapNG, Pcap-over-IP, and PacketCache data in addition to PCAP, ETL, and live sniffing, and exports results to CSV, JSON-LD, and XML. Its protocol features include file extraction across listed protocols, while VoIP support includes audio extraction from unencrypted calls. Professional also provides OSINT lookups for hashes, IP addresses, domains, and URLs. NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions. Extracted data stays on the end-user device rather than in the cloud. The source code is GPLv2 free and open source. Netresec warns that opening PCAPs can automatically extract malware and recommends Linux or Windows Sandbox to reduce self-infection risk.