Colasoft Capsa vs NetworkMiner

Colasoft Capsa is a Windows network analyzer for monitoring, analyzing and troubleshooting wired and wireless networks. The Enterprise edition captures packets in real time from local networks and can save transmitted data. It analyzes more than 1,800 protocols and sub-protocols, including VoIP, and displays packet details in Hex, ASCII and EBCDIC. Capsa can diagnose network problems and suggest solutions, monitor conversations, reconstruct packet streams and generate reports for selected items, the whole network or a particular network group. Its security analysis detects DoS and DDoS attacks, worm activity, ARP attacks, TCP port scans and suspicious conversations in real time. Users can set email or sound alerts and schedule capture once, daily or weekly. Capsa Free monitors up to 10 IP addresses, ends sessions after four hours and lacks WiFi connection monitoring. Professional is listed at $695, paid once for a single-seat perpetual license, one machine and one year of maintenance. Enterprise is $1,295, paid once and has a 30-day trial.

NetworkMiner analyzes captured network traffic and can sniff live traffic, extracting artifacts such as files, images, emails, and passwords from PCAP files. It also builds a host inventory from IP address information for passive asset discovery and communication overviews. The free edition supports live sniffing and PCAP and ETL parsing on Windows and Linux, but not PcapNG parsing. Professional accepts PcapNG, Pcap-over-IP, and PacketCache data in addition to PCAP, ETL, and live sniffing, and exports results to CSV, JSON-LD, and XML. Its protocol features include file extraction across listed protocols, while VoIP support includes audio extraction from unencrypted calls. Professional also provides OSINT lookups for hashes, IP addresses, domains, and URLs. NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions. Extracted data stays on the end-user device rather than in the cloud. The source code is GPLv2 free and open source. Netresec warns that opening PCAPs can automatically extract malware and recommends Linux or Windows Sandbox to reduce self-infection risk.