Colasoft Capsa vs. Wireshark

Capsa is highly recommended to be used in small dense areas of a network where it makes sense to be able to run analytics off of a mirror port to gain insight into traffic trends. It is a costly product to install in branch locations, and requires a decent spec hardware to run appropriately

Incentivized

I don't know of any other tool that works as well as Wireshark for packet capture an inspection. It's extremely easy to get up and running, and even with little to no knowledge of how to use the tool, you can be looking at all the traffic coming off a network interface.

Incentivized

• Robust Application. Able to handle traffic that most businesses will throw at it.
• Easy to use. Easy to setup captures and filter down to specific traffic types.
• Relatively cheap for what it's able to accomplish.

Incentivized

• Light-weight software - Does not require high end specifications; also runs smoothly on Legacy systems
• Filter function - Lets you filter you packets from thousands to tens so as to find your target much easily
• Simultaneous capturing on all the network adapters - You can capture packets from all the Network Interface Cards (NIC's) at once.

• Needs options to scale to 10Gb/s networks. The cutoff for performance looks to be around 3Gb/sl
• Needs API access to trigger capturesl
• Needs Agents for remote capturesl

Incentivized

• A more user-friendly interface would be nice, but then again it is not really designed for those who are not quite comfortable with this type of software.
• Changes to functionality on updates - this can sometimes happen unexpectedly and can be an annoyance.
• More powerful data processing would be welcomed

Incentivized

I give Wireshark a 10 for usability because it is very usable. Just about anyone can capture packets within a few seconds of opening the program. The analysis is a science but as far as just using Wireshark; it's very easy.

Incentivized

I don't believe Wireshark has "true" support as the software is open source. However, there is an active & friendly community around Wireshark that are more than happy to help answer questions. From a comprehensive Wiki and FAQ section on the site to the Ask a Question forum and bug tracker section, there's plenty of support options to make sure your questions and issues are addressed.

Incentivized

Simple and easy setup.

Incentivized

Colasoft performs more like the traditional wireshark as opposed to other solutions that tend to focus on graphs instead of giving you the raw data. I personally prefer the raw data, and then the ability to build graphs upon this (which Capsa can do). This allows for quicker analysis and makes it easier to relate to.

Incentivized

Wireshark is a free tool that came highly recommended by one of our former network security consultants. Using the tool he was able to resolve all of our higher tier network tickets, so we observed first hand why we needed to add Wireshark into our toolset. We received in-depth instruction and training scenarios that demonstrated the effectiveness and power of the product, so we didn't spend any time reviewing competing products.

Incentivized

• While the product doesn't detect malware, it has helped track down malware infected machines by using data from other applications to run filters to look for known traffic destinations for that malware. For me this is a huge ROI since malware can be the great unknown.
• Relatively cheap compared to the feature set.

Incentivized

• Identifying bugs in the network has never been smooth and near-perfect.
• Wireshark has made sure our equipment and software is working properly via analyzing network data.
• Analysis of IP packets and Sip call flaws has saved us a lot of time and confident result.

Incentivized