NETCAP vs Zui
NETCAP
netcap.io
Zui
zui.brimdata.ioSide by side
| Figure | NETCAP | Zui |
|---|---|---|
| Price from | €49/mo | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | Yes | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 3 | 1 |
| Spec score · Network Packet Analyzer Software | 9.2 (#2) | 7.3 (#29) |
| Spec score · Network Protocol Analyzers | 9.1 (#2) | 7.3 (#27) |
| Headquarters | Amsterdam, Netherlands | South San Francisco, California, United States |
| Purpose | NETCAP converts network packet streams into structured audit records for network analysis, security research, machine learning, and forensics. | Zui is a desktop application for querying and debugging Zed lakes. |
| Security | The download page says Pro analyzes captures locally on the user's machine and has no upload step. | The maker says Zui releases are signed with a code signing certificate to indicate the installer came from Brim Data and has not been tampered with since it was built. |
| Support | Pro includes email support, Enterprise offers priority support with an SLA, and Core lists community support. | The installation guide directs users who need help to troubleshooting documentation and the public Slack community. |
Plans
In their own words
NETCAP
NETCAP converts network packet streams into structured audit records for network analysis, security research, machine learning and forensics. Its free Core edition covers 66+ record types for protocols including TCP, UDP, HTTP, TLS, DNS and DHCP. Core captures live traffic, processes PCAP files, supports distributed collection and HTTP proxy capture, and outputs Protocol Buffers, CSV, JSON streams and Prometheus metrics. It is an open-source CLI under GPL-3.0, with platform binaries and Docker images.
Pro adds interactive graph analysis, a network activity timeline, investigation notes and more than 35 analysis modules. It can flag anomalies in decoded traffic and draft incident reports for editing; the maker says Pro analyzes captures locally without an upload step. Pro is available for macOS, Windows and Linux and includes email support. The plan is listed at $548 a month, with a €48/year option also shown, and a 14-day trial without a credit card. Enterprise has custom pricing and includes unlimited team seats, priority support with an SLA, custom integrations and volume licensing.
Zui
Zui is a free desktop application for exploring, querying, and debugging data in Zed lakes. It runs on Linux, macOS, and Windows, with drag-and-drop ingest, schema inference, named queries, filters, and pivots. Users can preview and shape data while loading it; imported data is stored locally under the Zui data directory, and the application can also connect to a remote Zed lake.
For packet capture analysis, bundled Brimcap creates Zeek and Suricata summary logs, and Zui can extract packet flows. Packet views can correlate Zeek events with Suricata alerts and offer right-click queries to VirusTotal or whois. Bundled Suricata uses Emerging Threats Open rules by default and updates them when Zui launches while connected to the internet. The maker says releases are signed with a code signing certificate to indicate the installer came from Brim Data and has not been changed since it was built. Brim Data continues to publish legacy Zed and Zui releases and documentation while developing SuperDB. Linux updates require manually uninstalling and reinstalling; the installation guide points users to troubleshooting documentation and a public Slack community.