NetworkMiner vs tcpflow

NetworkMiner

Description: NetworkMiner is an open source network forensic analysis tool used to analyze network traffic, detect operating systems, sessions, hostnames, open ports etc. It can be used by network administrators and cybersecurity professionals.

Type: software

Pricing: Open Source

tcpflow

Description: tcpflow is an open source tool for capturing TCP traffic flows. It works by capturing packets from network interfaces or packet capture files, reassembling TCP streams, and storing application-layer data with relevant TCP metadata.

Type: software

Pricing: Open Source

NetworkMiner Features

• Packet capture from live network
• Packet parsing and TCP reassembly
• Fingerprinting of operating systems
• Extraction of files transferred over the network
• Detection of hostnames and open ports
• Exporting of data for further analysis

tcpflow Features

• Captures TCP traffic flows from live network interfaces or packet capture files
• Reassembles TCP streams and stores application-layer data
• Stores TCP metadata like sequence numbers, acknowledgments, window advertisements
• Supports BPF filters for selective capturing
• Outputs flows in various formats like ASCII, CSV, JSON
• Can extract files based on signatures
• Has a library API for programmatic access

NetworkMiner

• Open Source

tcpflow

• Open Source