NetworkMiner vs SentryWire

NetworkMiner analyzes captured network traffic and can sniff live traffic, extracting artifacts such as files, images, emails, and passwords from PCAP files. It also builds a host inventory from IP address information for passive asset discovery and communication overviews. The free edition supports live sniffing and PCAP and ETL parsing on Windows and Linux, but not PcapNG parsing. Professional accepts PcapNG, Pcap-over-IP, and PacketCache data in addition to PCAP, ETL, and live sniffing, and exports results to CSV, JSON-LD, and XML. Its protocol features include file extraction across listed protocols, while VoIP support includes audio extraction from unencrypted calls. Professional also provides OSINT lookups for hashes, IP addresses, domains, and URLs. NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions. Extracted data stays on the end-user device rather than in the cloud. The source code is GPLv2 free and open source. Netresec warns that opening PCAPs can automatically extract malware and recommends Linux or Windows Sandbox to reduce self-infection risk.

SentryWire is a packet-capture appliance and network security monitoring platform for retaining and examining network traffic. It captures from 1 Mbps to above 1 Tbps and supports retention measured in weeks, months, or years. Distributed storage and compute enable searches across historical packet data, while forensic replay helps investigate traffic. Integrated Suricata IDS provides real-time detection and retrospective review. Analysis includes IDS search-back, BPF-syntax filtering, file-artifact extraction, JA3 hashing, GeoIP and ASN enrichment, Kibana dashboards, and display filters. Integrations named by the maker include Splunk, Elastic, Cisco, Palo Alto Networks, Fortinet, IBM, and Dell, with 25+ others supported. Deployment options include virtual machines, hardware appliances, portable systems, and cluster nodes; virtual machines capture up to 500 Mbps. SentryWire supports live capture, offline trace analysis, and PCAP files, and can retrieve packets from Splunk SOAR or Cortex XSOAR playbooks. Pricing is provided through sales contact.