nChronos vs NetworkMiner

nChronos is Colasoft’s application-focused network performance analysis system for medium and large corporate networks. Its client/server design places continuous packet capture, analysis, storage and data mining on a server, while a console displays and analyzes the collected data. The server can receive traffic through a network mirror port or link tap and retain packets for later investigation of network or application problems. Real-time statistics and user-defined alerts show network events as they occur. System or custom reports can be scheduled for hourly, daily, weekly or monthly email delivery. Users can define application and transaction monitoring, with profiles for HTTP, FTP, email and DNS. Packet files can be replayed from Colasoft, libpcap and several vendor formats, including files associated with Wireshark, Ethereal and Tcpdump. Linux server systems and Windows consoles are listed, with browser-based server configuration. Standard specifications allow four logical links, eight capture interfaces and two concurrent server connections.

NetworkMiner analyzes captured network traffic and can sniff live traffic, extracting artifacts such as files, images, emails, and passwords from PCAP files. It also builds a host inventory from IP address information for passive asset discovery and communication overviews. The free edition supports live sniffing and PCAP and ETL parsing on Windows and Linux, but not PcapNG parsing. Professional accepts PcapNG, Pcap-over-IP, and PacketCache data in addition to PCAP, ETL, and live sniffing, and exports results to CSV, JSON-LD, and XML. Its protocol features include file extraction across listed protocols, while VoIP support includes audio extraction from unencrypted calls. Professional also provides OSINT lookups for hashes, IP addresses, domains, and URLs. NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions. Extracted data stays on the end-user device rather than in the cloud. The source code is GPLv2 free and open source. Netresec warns that opening PCAPs can automatically extract malware and recommends Linux or Windows Sandbox to reduce self-infection risk.