NetworkMiner vs Zui

NetworkMiner analyzes captured network traffic and can sniff live traffic, extracting artifacts such as files, images, emails, and passwords from PCAP files. It also builds a host inventory from IP address information for passive asset discovery and communication overviews. The free edition supports live sniffing and PCAP and ETL parsing on Windows and Linux, but not PcapNG parsing. Professional accepts PcapNG, Pcap-over-IP, and PacketCache data in addition to PCAP, ETL, and live sniffing, and exports results to CSV, JSON-LD, and XML. Its protocol features include file extraction across listed protocols, while VoIP support includes audio extraction from unencrypted calls. Professional also provides OSINT lookups for hashes, IP addresses, domains, and URLs. NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions. Extracted data stays on the end-user device rather than in the cloud. The source code is GPLv2 free and open source. Netresec warns that opening PCAPs can automatically extract malware and recommends Linux or Windows Sandbox to reduce self-infection risk.

Zui is a free desktop application for exploring, querying, and debugging data in Zed lakes. It runs on Linux, macOS, and Windows, with drag-and-drop ingest, schema inference, named queries, filters, and pivots. Users can preview and shape data while loading it; imported data is stored locally under the Zui data directory, and the application can also connect to a remote Zed lake.

For packet capture analysis, bundled Brimcap creates Zeek and Suricata summary logs, and Zui can extract packet flows. Packet views can correlate Zeek events with Suricata alerts and offer right-click queries to VirusTotal or whois. Bundled Suricata uses Emerging Threats Open rules by default and updates them when Zui launches while connected to the internet. The maker says releases are signed with a code signing certificate to indicate the installer came from Brim Data and has not been changed since it was built. Brim Data continues to publish legacy Zed and Zui releases and documentation while developing SuperDB. Linux updates require manually uninstalling and reinstalling; the installation guide points users to troubleshooting documentation and a public Slack community.