NETCAP vs termshark

NETCAP converts network packet streams into structured audit records for network analysis, security research, machine learning and forensics. Its free Core edition covers 66+ record types for protocols including TCP, UDP, HTTP, TLS, DNS and DHCP. Core captures live traffic, processes PCAP files, supports distributed collection and HTTP proxy capture, and outputs Protocol Buffers, CSV, JSON streams and Prometheus metrics. It is an open-source CLI under GPL-3.0, with platform binaries and Docker images.

Pro adds interactive graph analysis, a network activity timeline, investigation notes and more than 35 analysis modules. It can flag anomalies in decoded traffic and draft incident reports for editing; the maker says Pro analyzes captures locally without an upload step. Pro is available for macOS, Windows and Linux and includes email support. The plan is listed at $548 a month, with a €48/year option also shown, and a 14-day trial without a credit card. Enterprise has custom pricing and includes unlimited team seats, priority support with an SLA, custom integrations and volume licensing.

termshark is a terminal interface for tshark, inspired by Wireshark, for inspecting packet captures and network traffic. It can read pcap files or sniff live interfaces when tshark is permitted, including on a remote machine where a capture need not be copied to a desktop. Users can apply Wireshark display filters, group conversations by protocol, and reassemble TCP and UDP streams. Packet search covers packet lists, structures and bytes, using text, regular expressions, hexadecimal input or display filters. The guide also describes importing a Wireshark column set when the configuration can be found, and transferring the current capture with Magic Wormhole. The project lists Linux, macOS, BSD variants, Android through Termux and Windows. It is free and MIT-licensed, and the project says its Go implementation builds as one executable on each platform. Packet analysis requires tshark 1.10.2 or higher in the user's PATH. The project notes that some tshark features are not yet exposed by termshark; the latest listed release is v2.4.0, dated July 11, 2022.