CapAnalysis vs NetworkMiner

CapAnalysis is a free, open-source web visual tool for examining captured network traffic on Linux. It indexes PCAP datasets and displays TCP, UDP, and ESP streams or flows, including geographic connection views. The web viewer handles individual PCAP files and sets of files. TCP analysis reports bytes lost in each direction and total bytes exchanged without counting retransmitted packets. Deep Packet Inspection identifies more than 140 protocols, allowing protocol-based flow filtering. Other filters cover IP address or port, destination country, data size, and date and time. An included MaxMind database identifies destination countries for IPv4 and IPv6 connections. PCAP files can also be imported from public URLs, including URLs pointing to ZIP archives. Debian and Ubuntu packages are listed in 32-bit and 64-bit versions. After installation, users open the application through a browser on port 9877. The demo accepts PCAP files up to 20 MB and deletes dataset data the following day at 00:00 UTC.

NetworkMiner analyzes captured network traffic and can sniff live traffic, extracting artifacts such as files, images, emails, and passwords from PCAP files. It also builds a host inventory from IP address information for passive asset discovery and communication overviews. The free edition supports live sniffing and PCAP and ETL parsing on Windows and Linux, but not PcapNG parsing. Professional accepts PcapNG, Pcap-over-IP, and PacketCache data in addition to PCAP, ETL, and live sniffing, and exports results to CSV, JSON-LD, and XML. Its protocol features include file extraction across listed protocols, while VoIP support includes audio extraction from unencrypted calls. Professional also provides OSINT lookups for hashes, IP addresses, domains, and URLs. NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions. Extracted data stays on the end-user device rather than in the cloud. The source code is GPLv2 free and open source. Netresec warns that opening PCAPs can automatically extract malware and recommends Linux or Windows Sandbox to reduce self-infection risk.