EndaceVision vs NetworkMiner

EndaceVision is a browser-based application for investigating security threats and network or application performance issues from historical packet data. Analysts can search and filter recorded traffic by link name, application classification, IP or MAC address, port, timestamp, and other parameters. EndaceProbes use built-in deep packet inspection to classify captured traffic by application. Visualizations cover bandwidth over time, conversations, traffic over time, and top talkers. MicroVision uses packet timestamps to show short events at microsecond detail, including average and maximum values for each sample point. A hosted Wireshark instance lets analysts decode packets on EndaceProbes or InvestigationManager without downloading large captures. The datasheet lists role-based access control and TACACS security. Access runs in modern desktop or tablet browsers with appropriate credentials. EndaceVision is included on EndaceProbe Analytics Platforms and InvestigationManager, with pcap and ERF capture formats listed. It is aimed at security, network, and IT teams. Endace was founded in 2001 and is headquartered in Auckland, New Zealand. Pricing is available on request.

NetworkMiner analyzes captured network traffic and can sniff live traffic, extracting artifacts such as files, images, emails, and passwords from PCAP files. It also builds a host inventory from IP address information for passive asset discovery and communication overviews. The free edition supports live sniffing and PCAP and ETL parsing on Windows and Linux, but not PcapNG parsing. Professional accepts PcapNG, Pcap-over-IP, and PacketCache data in addition to PCAP, ETL, and live sniffing, and exports results to CSV, JSON-LD, and XML. Its protocol features include file extraction across listed protocols, while VoIP support includes audio extraction from unencrypted calls. Professional also provides OSINT lookups for hashes, IP addresses, domains, and URLs. NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions. Extracted data stays on the end-user device rather than in the cloud. The source code is GPLv2 free and open source. Netresec warns that opening PCAPs can automatically extract malware and recommends Linux or Windows Sandbox to reduce self-infection risk.