Scapy vs Xplico
Scapy
scapy.netXplico
xplico.orgSide by side
| Figure | Scapy | Xplico |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Network Packet Analyzer Software | 8.4 (#7) | 7.3 (#28) |
| Licensing | Scapy code, tests and tools are licensed under GPL v2, while its documentation is licensed under CC BY-NC-SA 2.5. | The Xplico decoder, DeMa and listed manipulators are GPL v2.0, while Xplico Interface can use MPL 1.1 or later, GPL 2.0 or later, or LGPL 2.1 or later. |
| Purpose | Scapy is a Python program for sending, sniffing, dissecting and forging network packets. | Xplico extracts application data from internet traffic captures and is an open-source Network Forensic Analysis Tool. |
Plans
In their own words
Scapy
Scapy is a free Python packet manipulation program and library for forging or decoding packets, sending and capturing them, and matching requests with replies. It can run as an interactive shell or be used as a library. Listed tasks include scanning, tracerouting, probing, unit tests, attacks and network discovery. Users can set arbitrary field values and stack protocol layers rather than rely on predetermined templates; after a probe, Scapy returns full decoded packets before interpretation for further analysis. It can read and store pcap files, inject invalid frames and custom 802.11 frames, and be extended with protocols and add-ons. Scapy runs on Linux, macOS, BSD and Windows, though Windows installation requires Npcap. Optional plotting needs Matplotlib; TLS decryption and PKI operations need the cryptography package. The code, tests and tools use GPL v2, while the documentation uses CC BY-NC-SA 2.5. Documentation includes installation instructions, usage guides, troubleshooting and an API reference. The project supports only its latest master version, and critical bugs should be reported privately through GitHub’s security tab.
Xplico
Xplico is free, open-source network forensic software that extracts application data from PCAP traffic captures. It can recover email, HTTP content, VoIP calls, and FTP or TFTP data, with protocol support for HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, and IPv6. Port Independent Protocol Identification recognizes application protocols without depending on port numbers. Processing supports multithreading and realtime operation, although speed depends on flows, protocol types, and computer resources. Results can be written to files or SQLite and MySQL databases. A web interface lets concurrent users manage one or more cases, using SQLite, MySQL, or PostgreSQL as a backend. Modular capture, dissector, and dispatcher components can target files, databases, or network sockets. Downloads cover Fedora, CentOS/RHEL, and Ubuntu, alongside source code and a VirtualBox image. The free plan costs nothing; data-entry and input-file counts are unrestricted, with hard-drive size as the stated limit.