Colasoft Capsa vs. NetworkMiner

Capsa is highly recommended to be used in small dense areas of a network where it makes sense to be able to run analytics off of a mirror port to gain insight into traffic trends. It is a costly product to install in branch locations, and requires a decent spec hardware to run appropriately

Incentivized

The NetworkMiner software in my view is a software recommended for small and/or large companies, it may be less useful in small companies or offices, but it can also be used for simple analysis. In medium and large scenarios, it is very useful in analyzing network traffic and identifying possible security flaws, password exposures and weaknesses in the security of solutions and/or technologies used in the internal network.

Incentivized

• Robust Application. Able to handle traffic that most businesses will throw at it.
• Easy to use. Easy to setup captures and filter down to specific traffic types.
• Relatively cheap for what it's able to accomplish.

Incentivized

• Credential capture exclusive tab
• Graphical interface for data analysis
• Exclusive intuitive host connection listing tab

Incentivized

• Needs options to scale to 10Gb/s networks. The cutoff for performance looks to be around 3Gb/sl
• Needs API access to trigger capturesl
• Needs Agents for remote capturesl

Incentivized

• MAC listing of hosts in listed connections
• Possibility to start capture focusing on only a specific host

Incentivized

Colasoft performs more like the traditional wireshark as opposed to other solutions that tend to focus on graphs instead of giving you the raw data. I personally prefer the raw data, and then the ability to build graphs upon this (which Capsa can do). This allows for quicker analysis and makes it easier to relate to.

Incentivized

• While the product doesn't detect malware, it has helped track down malware infected machines by using data from other applications to run filters to look for known traffic destinations for that malware. For me this is a huge ROI since malware can be the great unknown.
• Relatively cheap compared to the feature set.

Incentivized

• Increase in the possibility of identifying security flaws in trafficked data
• Monitor network traffic easily with no financial investment

Incentivized