NetworkMiner vs Xplico

NetworkMiner analyzes captured network traffic and can sniff live traffic, extracting artifacts such as files, images, emails, and passwords from PCAP files. It also builds a host inventory from IP address information for passive asset discovery and communication overviews. The free edition supports live sniffing and PCAP and ETL parsing on Windows and Linux, but not PcapNG parsing. Professional accepts PcapNG, Pcap-over-IP, and PacketCache data in addition to PCAP, ETL, and live sniffing, and exports results to CSV, JSON-LD, and XML. Its protocol features include file extraction across listed protocols, while VoIP support includes audio extraction from unencrypted calls. Professional also provides OSINT lookups for hashes, IP addresses, domains, and URLs. NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions. Extracted data stays on the end-user device rather than in the cloud. The source code is GPLv2 free and open source. Netresec warns that opening PCAPs can automatically extract malware and recommends Linux or Windows Sandbox to reduce self-infection risk.

Xplico is free, open-source network forensic software that extracts application data from PCAP traffic captures. It can recover email, HTTP content, VoIP calls, and FTP or TFTP data, with protocol support for HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, and IPv6. Port Independent Protocol Identification recognizes application protocols without depending on port numbers. Processing supports multithreading and realtime operation, although speed depends on flows, protocol types, and computer resources. Results can be written to files or SQLite and MySQL databases. A web interface lets concurrent users manage one or more cases, using SQLite, MySQL, or PostgreSQL as a backend. Modular capture, dissector, and dispatcher components can target files, databases, or network sockets. Downloads cover Fedora, CentOS/RHEL, and Ubuntu, alongside source code and a VirtualBox image. The free plan costs nothing; data-entry and input-file counts are unrestricted, with hard-drive size as the stated limit.