Side by side
NetworkMiner vs TShark
Both stand on network packet analyzer software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan LinuxMacWindows
NetworkMiner offers a free starting point for traffic analysis, with Professional adding more inputs, exports and analysis features. Keep its TLS decryption limitation and PCAP malware warning in mind; the listed licenses also have different costs and terms.
Visit NetworkMiner Free plan LinuxMacWindows
TShark provides terminal-based capture and analysis with multiple output formats and Wireshark-compatible display filters. Note the filter restriction when saving captures with -w, as well as the stated file-size limit.
Visit TSharkThe facts
| NetworkMiner | TShark | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | Linux, Mac, Windows | Linux, Mac, Windows |
| Lowest paid plan | Single User License: $1,300, paid once | Free or on request |
| Plans published | 3 | 1 |
| Maker | Not published | Not published |
| Website | netresec.com | wireshark.org |
| On network packet analyzer software | #10 of 32 | #19 of 32 |
NetworkMiner: what it does well
- Free edition supports live sniffing and PCAP/ETL parsing.
- Professional supports PcapNG and additional capture inputs.
- Professional exports CSV, JSON-LD and XML.
- Extracted data remains on the end-user device.
- GPLv2 free and open-source code.
What to know first
- Free edition does not parse PcapNG.
- Does not decrypt HTTPS or other TLS sessions.
- Single User License costs $1,300, paid once.
- Opening PCAPs can automatically extract malware.
TShark: what it does well
- Captures live traffic or reads saved captures.
- Supports Wireshark display-filter syntax.
- Outputs fields, JSON, PDML, and text.
- Can pipe output to another program or script.
- Free under GNU GPL version 2.
What to know first
- Display filters are unavailable with capture saving via -w.
- Capture files have a 2 TB maximum.
- Manual notes possible issues above 2^32 packets.
Alternatives to NetworkMiner Alternatives to TShark The whole list