Airtool Pi vs SentryWire

Airtool Pi is an iPhone and iPad utility for remote Wi-Fi packet capture. It connects over SSH to Linux-based sensors or Linux endpoints with compatible adapters, starts a capture using selected settings, and saves a PcapNG file locally. Sensors can be added manually or automatically, including WLAN Pi and Oscium Nomad; version history also names WLAN Pi Go and Hamina Clip, and a Raspberry Pi can serve as a sensor. Capture controls include wireless interface, frequency band, channel, channel width, size limits, and an option to discard data-frame payloads. The App Store listing states support for 2.4, 5, and 6 GHz bands and widths from 20 to 320 MHz. Compatible adapters allow simultaneous capture on up to four channels. Files can be shared with Wireshark or another protocol analyzer. Airtool Pi costs $14.99 USD once and requires iOS or iPadOS 18.6 or later.

SentryWire is a packet-capture appliance and network security monitoring platform for retaining and examining network traffic. It captures from 1 Mbps to above 1 Tbps and supports retention measured in weeks, months, or years. Distributed storage and compute enable searches across historical packet data, while forensic replay helps investigate traffic. Integrated Suricata IDS provides real-time detection and retrospective review. Analysis includes IDS search-back, BPF-syntax filtering, file-artifact extraction, JA3 hashing, GeoIP and ASN enrichment, Kibana dashboards, and display filters. Integrations named by the maker include Splunk, Elastic, Cisco, Palo Alto Networks, Fortinet, IBM, and Dell, with 25+ others supported. Deployment options include virtual machines, hardware appliances, portable systems, and cluster nodes; virtual machines capture up to 500 Mbps. SentryWire supports live capture, offline trace analysis, and PCAP files, and can retrieve packets from Splunk SOAR or Cortex XSOAR playbooks. Pricing is provided through sales contact.