Colasoft Capsa vs. PathSolutions TotalView vs. Wireshark

Capsa is highly recommended to be used in small dense areas of a network where it makes sense to be able to run analytics off of a mirror port to gain insight into traffic trends. It is a costly product to install in branch locations, and requires a decent spec hardware to run appropriately

Incentivized

TotalView is well suited for an infrastructure where you are looking for a cost-effective, additive network management tool for in-depth device diagnostic information. This will not be a one-stop shop application, but it does what is advertised very well. SNMP is required for configuration and adding additional devices is quick and simple. This product also works well with Shoretel VoIP systems and allows for a full overview of connected phones along with being able to view calls on an extension/IP basis.

I don't know of any other tool that works as well as Wireshark for packet capture an inspection. It's extremely easy to get up and running, and even with little to no knowledge of how to use the tool, you can be looking at all the traffic coming off a network interface.

Incentivized

• Robust Application. Able to handle traffic that most businesses will throw at it.
• Easy to use. Easy to setup captures and filter down to specific traffic types.
• Relatively cheap for what it's able to accomplish.

Incentivized

• The setup is fast and easy - 500 devices in 20 minutes.
• The ability to go back a day or a week in time allows us to more easily troubleshoot the "what happened at 3 a.m. yesterday" question.
• It gives us easily accessible stats for checks and balances like device types, counts, models, serial number etc.

• Light-weight software - Does not require high end specifications; also runs smoothly on Legacy systems
• Filter function - Lets you filter you packets from thousands to tens so as to find your target much easily
• Simultaneous capturing on all the network adapters - You can capture packets from all the Network Interface Cards (NIC's) at once.

• Needs options to scale to 10Gb/s networks. The cutoff for performance looks to be around 3Gb/sl
• Needs API access to trigger capturesl
• Needs Agents for remote capturesl

Incentivized

• If you have some complexities in your network addressing, the network diagram tool will lay everything out automatically, but it will be confusing to look at. There is a way to edit the diagram so it looks more intuitive, but it may require some time to edit everything the right way.
• TotalView will count virtual interfaces such as voice dial-peers and service modules as "ports," which counts against your license count. However, there is a way to edit each device to remove these "false positives" so it doesn't suck up licenses, but it can take some time to clean those up.

• A more user-friendly interface would be nice, but then again it is not really designed for those who are not quite comfortable with this type of software.
• Changes to functionality on updates - this can sometimes happen unexpectedly and can be an annoyance.
• More powerful data processing would be welcomed

Incentivized

It's very simple and easy to use, although individuals not used to managing and administering networks would take some time to get familiar with it. Once they have mastered use of the application, it's easy to stay knowledgeable about it, iteration after iteration. It is well supported online through an open-source community network of professionals who are helpful in imparting knowledge and in providing assistance.

Incentivized

I don't believe Wireshark has "true" support as the software is open source. However, there is an active & friendly community around Wireshark that are more than happy to help answer questions. From a comprehensive Wiki and FAQ section on the site to the Ask a Question forum and bug tracker section, there's plenty of support options to make sure your questions and issues are addressed.

Incentivized

Simple and easy setup.

Incentivized

Colasoft performs more like the traditional wireshark as opposed to other solutions that tend to focus on graphs instead of giving you the raw data. I personally prefer the raw data, and then the ability to build graphs upon this (which Capsa can do). This allows for quicker analysis and makes it easier to relate to.

Incentivized

The three tools listed do different things with some similarities. For us the biggest need was data analysis, semi-automatic troubleshooting, and data gathering and topology mapping. TotalView hit the most of these in the price point we were looking for. Each tool has "extras," but we felt that the extras provided by TotalView were good enough and that the other tools didn't justify the cost.

Wireshark is a free tool that came highly recommended by one of our former network security consultants. Using the tool he was able to resolve all of our higher tier network tickets, so we observed first hand why we needed to add Wireshark into our toolset. We received in-depth instruction and training scenarios that demonstrated the effectiveness and power of the product, so we didn't spend any time reviewing competing products.

Incentivized

• While the product doesn't detect malware, it has helped track down malware infected machines by using data from other applications to run filters to look for known traffic destinations for that malware. For me this is a huge ROI since malware can be the great unknown.
• Relatively cheap compared to the feature set.

Incentivized

• Wuite possibly the best spent money i have recommended in my 20+ year IT career.

• Identifying bugs in the network has never been smooth and near-perfect.
• Wireshark has made sure our equipment and software is working properly via analyzing network data.
• Analysis of IP packets and Sip call flaws has saved us a lot of time and confident result.

Incentivized