PacketSnitch vs Zui

PacketSnitch is a desktop application for investigating network traffic in PCAP and PCAPNG captures. It turns files into searchable, protocol-aware information and can extract hosts, credentials, certificates, files, locations, protocols, anomalies and threat-intelligence hits. Analysis tools include stream reconstruction, protocol decoding, complex filters, visualizations, threat-intelligence scoring, file carving, GeoIP enrichment and capture workspaces. Traffic decryption, flow analysis and CLI tools are also listed. ZIP-packaged plugins can be installed through Settings. The bundled Python backend parses captures locally, and the maker says captures are not uploaded. Optional network activity includes configured LLM calls, threat-intelligence lookups and anonymous metrics; metrics can be disabled in Settings. Optional LLM analysis supports Ollama, OpenRouter and Cohere when configured. New installations get full features in Demo mode for 30 days, then move to Free mode with core analysis and reduced functionality. Prebuilt installers are available for Windows 10/11 and Linux DEB or RPM distributions. macOS has no signed installer, though running from source is described. The maker says analysis outputs may not be accurate or complete and should be independently validated before consequential use.

Zui is a free desktop application for exploring, querying, and debugging data in Zed lakes. It runs on Linux, macOS, and Windows, with drag-and-drop ingest, schema inference, named queries, filters, and pivots. Users can preview and shape data while loading it; imported data is stored locally under the Zui data directory, and the application can also connect to a remote Zed lake.

For packet capture analysis, bundled Brimcap creates Zeek and Suricata summary logs, and Zui can extract packet flows. Packet views can correlate Zeek events with Suricata alerts and offer right-click queries to VirusTotal or whois. Bundled Suricata uses Emerging Threats Open rules by default and updates them when Zui launches while connected to the internet. The maker says releases are signed with a code signing certificate to indicate the installer came from Brim Data and has not been changed since it was built. Brim Data continues to publish legacy Zed and Zui releases and documentation while developing SuperDB. Linux updates require manually uninstalling and reinstalling; the installation guide points users to troubleshooting documentation and a public Slack community.