Colasoft Capsa vs netsniff-ng

Colasoft Capsa is a Windows network analyzer for monitoring, analyzing and troubleshooting wired and wireless networks. The Enterprise edition captures packets in real time from local networks and can save transmitted data. It analyzes more than 1,800 protocols and sub-protocols, including VoIP, and displays packet details in Hex, ASCII and EBCDIC. Capsa can diagnose network problems and suggest solutions, monitor conversations, reconstruct packet streams and generate reports for selected items, the whole network or a particular network group. Its security analysis detects DoS and DDoS attacks, worm activity, ARP attacks, TCP port scans and suspicious conversations in real time. Users can set email or sound alerts and schedule capture once, daily or weekly. Capsa Free monitors up to 10 IP addresses, ends sessions after four hours and lacks WiFi connection monitoring. Professional is listed at $695, paid once for a single-seat perpetual license, one machine and one year of maintenance. Enterprise is $1,295, paid once and has a 30-day trial.

netsniff-ng is a free Linux network analyzer and toolkit for network development, debugging, analysis, auditing, and reconnaissance. It captures, analyzes, replays, and redirects traffic using zero-copy packet mechanisms, with live capture, command-line operation, display filters, and offline trace analysis. Supported capture files include tcpdump-capable pcap, a nanosecond-resolution tcpdump-capable variant, Alexey Kuznetzov's pcap, and netsniff-ng pcap. Low- and high-level filtering include Berkeley Packet Filter expressions. The toolkit combines netsniff-ng, trafgen, mausezahn, ifpps, curvetun, astraceroute, flowtop, and bpfc. Its dissector covers Ethernet, WLAN, ARP, MPLS, VLAN, LLDP, IPv4, IPv6, ICMP, IGMP, TCP, and UDP. Mausezahn and curvetun are experimental and not advised for production. The toolkit is GPL 2.0 open source. Release checks use Git tags and GPG signatures; support is through a mailing list and online FAQ.