netsniff-ng vs Wireshark
netsniff-ng
netsniff-ng.orgWireshark
wireshark.orgSide by side
| Figure | netsniff-ng | Wireshark |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 2 |
| Spec score · Network Packet Capture Software | 7.4 (#13) | 8.2 (#6) |
| Spec score · Network Packet Analyzer Software | 7.4 (#24) | 8.3 (#10) |
| Filtering | netsniff-ng supports low-level and high-level packet filters, including Berkeley Packet Filter expressions. | Users can filter packets using many criteria, including display filters for addresses, ports and protocols. |
| License | The toolkit is open source under the GNU General Public License version 2.0. | Wireshark is open-source software released under the GNU General Public License version 2, and the downloaded version is the full version without a license fee. |
| Purpose | netsniff-ng is a free Linux network analyzer and networking toolkit for network development, debugging, analysis, auditing, and reconnaissance. | Wireshark captures and interactively browses network traffic as a network protocol analyzer. |
| Support | The project directs users to its mailing list and online FAQ for questions and feedback. | Community support is available through the Q&A site and Wireshark users mailing list. |
Plans
In their own words
netsniff-ng
netsniff-ng is a free Linux network analyzer and toolkit for network development, debugging, analysis, auditing, and reconnaissance. It captures, analyzes, replays, and redirects traffic using zero-copy packet mechanisms, with live capture, command-line operation, display filters, and offline trace analysis. Supported capture files include tcpdump-capable pcap, a nanosecond-resolution tcpdump-capable variant, Alexey Kuznetzov's pcap, and netsniff-ng pcap. Low- and high-level filtering include Berkeley Packet Filter expressions. The toolkit combines netsniff-ng, trafgen, mausezahn, ifpps, curvetun, astraceroute, flowtop, and bpfc. Its dissector covers Ethernet, WLAN, ARP, MPLS, VLAN, LLDP, IPv4, IPv6, ICMP, IGMP, TCP, and UDP. Mausezahn and curvetun are experimental and not advised for production. The toolkit is GPL 2.0 open source. Release checks use Git tags and GPG signatures; support is through a mailing list and online FAQ.
Wireshark
Wireshark is a free network protocol analyzer for capturing and examining network traffic. It supports live capture and offline analysis through a graphical interface or the TShark terminal utility, and can inspect hundreds of protocols. Display filters narrow what appears during analysis, though their syntax differs from capture filters. Wireshark reads and writes capture formats including pcap and pcapng, and can decompress gzip-compressed files. Analysis features include VoIP tools, packet coloring rules, and exports to XML, PostScript, CSV, or plain text. It can decrypt traffic for protocols including IPsec, Kerberos, SSL/TLS, WEP, and WPA/WPA2. The software is available for Linux, macOS, and Windows under GNU General Public License version 2, with no license fee for the full version. Windows packages include Npcap, which is needed for live packet capture. What a capture can show depends on the operating system, capture library, network interface, and network configuration; switched networks may not expose unicast traffic between other ports. Community help is available through a Q&A site and users mailing list.