PcapAI vs Scapy

PcapAI analyzes PCAP and PCAPNG network captures and creates security reports. Its machine-learning models evaluate packet context and relate findings to MITRE ATT&CK techniques. Reports are downloadable PDFs with risk scores, packet evidence, findings, and remediation steps. The service detects plaintext credentials, NTLM hashes, Kerberos tickets, and session tokens, then masks discovered credentials in reports. It also surfaces retransmissions, per-flow latency, TCP Zero Window events, and ARP conflicts. The homepage offers free uploads without an account; compressed archives are not accepted, and file-size limits vary by plan. Options include web, API, Windows, macOS, Linux, and self-hosted use. An open-source MCP Server supports local analysis with AI assistants such as Claude Desktop; the maker says packet data stays on the device. The Advanced plan includes API access, and the maker describes sending findings to Splunk, Elastic SIEM, or Microsoft Sentinel. Pricing includes a $9.00 USD one-time Single Report, monthly and annual plans, and one-time packs.

Scapy is a free Python packet manipulation program and library for forging or decoding packets, sending and capturing them, and matching requests with replies. It can run as an interactive shell or be used as a library. Listed tasks include scanning, tracerouting, probing, unit tests, attacks and network discovery. Users can set arbitrary field values and stack protocol layers rather than rely on predetermined templates; after a probe, Scapy returns full decoded packets before interpretation for further analysis. It can read and store pcap files, inject invalid frames and custom 802.11 frames, and be extended with protocols and add-ons. Scapy runs on Linux, macOS, BSD and Windows, though Windows installation requires Npcap. Optional plotting needs Matplotlib; TLS decryption and PKI operations need the cryptography package. The code, tests and tools use GPL v2, while the documentation uses CC BY-NC-SA 2.5. Documentation includes installation instructions, usage guides, troubleshooting and an API reference. The project supports only its latest master version, and critical bugs should be reported privately through GitHub’s security tab.