Colasoft Capsa vs Xplico

Colasoft Capsa is a Windows network analyzer for monitoring, analyzing and troubleshooting wired and wireless networks. The Enterprise edition captures packets in real time from local networks and can save transmitted data. It analyzes more than 1,800 protocols and sub-protocols, including VoIP, and displays packet details in Hex, ASCII and EBCDIC. Capsa can diagnose network problems and suggest solutions, monitor conversations, reconstruct packet streams and generate reports for selected items, the whole network or a particular network group. Its security analysis detects DoS and DDoS attacks, worm activity, ARP attacks, TCP port scans and suspicious conversations in real time. Users can set email or sound alerts and schedule capture once, daily or weekly. Capsa Free monitors up to 10 IP addresses, ends sessions after four hours and lacks WiFi connection monitoring. Professional is listed at $695, paid once for a single-seat perpetual license, one machine and one year of maintenance. Enterprise is $1,295, paid once and has a 30-day trial.

Xplico is free, open-source network forensic software that extracts application data from PCAP traffic captures. It can recover email, HTTP content, VoIP calls, and FTP or TFTP data, with protocol support for HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, and IPv6. Port Independent Protocol Identification recognizes application protocols without depending on port numbers. Processing supports multithreading and realtime operation, although speed depends on flows, protocol types, and computer resources. Results can be written to files or SQLite and MySQL databases. A web interface lets concurrent users manage one or more cases, using SQLite, MySQL, or PostgreSQL as a backend. Modular capture, dissector, and dispatcher components can target files, databases, or network sockets. Downloads cover Fedora, CentOS/RHEL, and Ubuntu, alongside source code and a VirtualBox image. The free plan costs nothing; data-entry and input-file counts are unrestricted, with hard-drive size as the stated limit.