HOMER vs NETCAP
HOMER
sipcapture.github.io
NETCAP
netcap.ioSide by side
| Figure | HOMER | NETCAP |
|---|---|---|
| Price from | — | €49/mo |
| Free plan | — | Yes |
| Free trial | — | Yes |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 3 |
| Spec score · Network Protocol Analyzers | 7.9 (#15) | 9.1 (#2) |
| API | Homer includes a Coordinator REST API gateway for its user interface and external applications. | The project exposes a Go Writer API for writing Protocol Buffer and CSV audit records, including headers and buffered channels. |
| Capture | The ingest module receives HEP packets over UDP, TCP, TLS, HTTP, and HTTPS. | Core captures live network traffic or processes PCAP files, and supports distributed collection and HTTP proxy capture. |
| Integrations | The project documents optional Arrow FlightSQL for Grafana and REST API access for the UI and external applications. | Pro lists handoffs or integrations with Wireshark, Metasploit, hashcat, John, and BetterCrack; Core includes a Maltego transformation plugin. |
| License | The Homer repository states that the software is released under the AGPL-3.0 license. | Core is GPL-3.0 copyleft; the maker also offers a separately negotiated commercial license for proprietary products. |
| Purpose | HOMER is an open-source SIP, VoIP, and RTC packet capture and monitoring system. | NETCAP converts network packet streams into structured audit records for network analysis, security research, machine learning, and forensics. |
| Security | Homer 11 documentation says protected API routes require authentication and describes generated JWT secrets when none is configured. | The download page says Pro analyzes captures locally on the user's machine and has no upload step. |
Plans
In their own words
NETCAP
NETCAP converts network packet streams into structured audit records for network analysis, security research, machine learning and forensics. Its free Core edition covers 66+ record types for protocols including TCP, UDP, HTTP, TLS, DNS and DHCP. Core captures live traffic, processes PCAP files, supports distributed collection and HTTP proxy capture, and outputs Protocol Buffers, CSV, JSON streams and Prometheus metrics. It is an open-source CLI under GPL-3.0, with platform binaries and Docker images.
Pro adds interactive graph analysis, a network activity timeline, investigation notes and more than 35 analysis modules. It can flag anomalies in decoded traffic and draft incident reports for editing; the maker says Pro analyzes captures locally without an upload step. Pro is available for macOS, Windows and Linux and includes email support. The plan is listed at $548 a month, with a €48/year option also shown, and a 14-day trial without a credit card. Enterprise has custom pricing and includes unlimited team seats, priority support with an SLA, custom integrations and volume licensing.