Ettercap vs PacketSnitch

Ettercap is a free, open-source suite for man-in-the-middle testing, live connection sniffing and network analysis. It dissects protocols actively or passively, filters packet payloads through compiled etterfilter rules, and performs network and host analysis. Passive LAN scanning can extract host, operating-system, port and gateway information from observed traffic. Command-line, graphical and ncurses interfaces are available, along with PCAP support, remote capture, traffic decryption and flow analysis. The project lists Linux and macOS platforms and supports self-hosted deployment. Tested systems include Debian/Ubuntu, Fedora, Gentoo, Pentoo, Mac OS X, FreeBSD, OpenBSD and NetBSD. The latest listed release is 0.8.4.1-Garofalo, released April 7, 2026, with a fix for an etterfilter heap out-of-bounds read identified as CVE-2026-3606. Downloads include SHA256 checksums. Source builds require libraries and tools such as libpcap, libnet, pthread, zlib, CMake, Flex and Bison. The project is community run under GPL-2.0.

PacketSnitch is a desktop application for investigating network traffic in PCAP and PCAPNG captures. It turns files into searchable, protocol-aware information and can extract hosts, credentials, certificates, files, locations, protocols, anomalies and threat-intelligence hits. Analysis tools include stream reconstruction, protocol decoding, complex filters, visualizations, threat-intelligence scoring, file carving, GeoIP enrichment and capture workspaces. Traffic decryption, flow analysis and CLI tools are also listed. ZIP-packaged plugins can be installed through Settings. The bundled Python backend parses captures locally, and the maker says captures are not uploaded. Optional network activity includes configured LLM calls, threat-intelligence lookups and anonymous metrics; metrics can be disabled in Settings. Optional LLM analysis supports Ollama, OpenRouter and Cohere when configured. New installations get full features in Demo mode for 30 days, then move to Free mode with core analysis and reduced functionality. Prebuilt installers are available for Windows 10/11 and Linux DEB or RPM distributions. macOS has no signed installer, though running from source is described. The maker says analysis outputs may not be accurate or complete and should be independently validated before consequential use.