Colasoft Capsa vs tcpdump

Colasoft Capsa is a Windows network analyzer for monitoring, analyzing and troubleshooting wired and wireless networks. The Enterprise edition captures packets in real time from local networks and can save transmitted data. It analyzes more than 1,800 protocols and sub-protocols, including VoIP, and displays packet details in Hex, ASCII and EBCDIC. Capsa can diagnose network problems and suggest solutions, monitor conversations, reconstruct packet streams and generate reports for selected items, the whole network or a particular network group. Its security analysis detects DoS and DDoS attacks, worm activity, ARP attacks, TCP port scans and suspicious conversations in real time. Users can set email or sound alerts and schedule capture once, daily or weekly. Capsa Free monitors up to 10 IP addresses, ends sessions after four hours and lacks WiFi connection monitoring. Professional is listed at $695, paid once for a single-seat perpetual license, one machine and one year of maintenance. Enterprise is $1,295, paid once and has a 30-day trial.

tcpdump is a network monitoring and data acquisition tool that captures traffic through libpcap, an interface for user-level packet capture. It provides command-line tools and PCAP support, and the project lists systems including AIX, BSD variants, GNU/Linux, macOS, Solaris, QNX, and Windows. It is free, with source code available through a public Git repository and native packages or ports on many systems.

Building requires libpcap and a C99-compliant compiler. Windows builds also require WinPcap or Npcap and Visual Studio with CMake. The license permits redistribution and use in source and binary forms under its conditions. Capture permissions depend on the operating system and its configuration; the project cautions that permitted users may capture network traffic, including passwords. Native packages may lag a few versions, while a newer snapshot can be compiled from source. The project lists Linux, macOS, and Windows among its platforms.