Wireshark vs Zui

Wireshark is a free network protocol analyzer for capturing and examining network traffic. It supports live capture and offline analysis through a graphical interface or the TShark terminal utility, and can inspect hundreds of protocols. Display filters narrow what appears during analysis, though their syntax differs from capture filters. Wireshark reads and writes capture formats including pcap and pcapng, and can decompress gzip-compressed files. Analysis features include VoIP tools, packet coloring rules, and exports to XML, PostScript, CSV, or plain text. It can decrypt traffic for protocols including IPsec, Kerberos, SSL/TLS, WEP, and WPA/WPA2. The software is available for Linux, macOS, and Windows under GNU General Public License version 2, with no license fee for the full version. Windows packages include Npcap, which is needed for live packet capture. What a capture can show depends on the operating system, capture library, network interface, and network configuration; switched networks may not expose unicast traffic between other ports. Community help is available through a Q&A site and users mailing list.

Zui is a free desktop application for exploring, querying, and debugging data in Zed lakes. It runs on Linux, macOS, and Windows, with drag-and-drop ingest, schema inference, named queries, filters, and pivots. Users can preview and shape data while loading it; imported data is stored locally under the Zui data directory, and the application can also connect to a remote Zed lake.

For packet capture analysis, bundled Brimcap creates Zeek and Suricata summary logs, and Zui can extract packet flows. Packet views can correlate Zeek events with Suricata alerts and offer right-click queries to VirusTotal or whois. Bundled Suricata uses Emerging Threats Open rules by default and updates them when Zui launches while connected to the internet. The maker says releases are signed with a code signing certificate to indicate the installer came from Brim Data and has not been changed since it was built. Brim Data continues to publish legacy Zed and Zui releases and documentation while developing SuperDB. Linux updates require manually uninstalling and reinstalling; the installation guide points users to troubleshooting documentation and a public Slack community.