EndaceProbe
EndaceProbe records network packets continuously, creating historical data for investigating security threats, performance problems, and outages.
What EndaceProbe is
EndaceProbe records network packets continuously, creating historical data for investigating security threats, performance problems, and outages. It is available as a physical appliance or through cloud and virtual deployments, including AWS, Microsoft Azure, VMware, KVM, and Nutanix. Listed models span 500 Mbps to 100 Gbps sustained recording, with packet storage from 1 TB to more than 3 PB. InvestigationManager provides centralized search and data mining, while EndaceCMS manages physical and cloud probes. Browser-based EndaceVision can search and examine historical packet data, and hosted Wireshark decodes packets without requiring large PCAP files to be downloaded. The product supports live capture, offline trace analysis, display filters, protocol decryption, and pcap, pcapng, and ERF formats. Endace lists prebuilt Elastic integrations and an API for other tools; appliances can also host third-party applications such as EndaceFlow. Endace describes security certifications and controls including FIPS 140-3 validation, Common Criteria certification for specified models, and DoDIN APL listing. Pricing is available on request.
Good
- Continuous packet capture and historical investigation
- Deployments include appliances, cloud, and virtual options
- Browser-based packet search with hosted Wireshark
- Supports pcap, pcapng, and ERF formats
Watch out
- Pricing is available on request
- Support covers only the current and previous major release
Who it suits
EndaceProbe is for organizations investigating network security, performance, and outage issues that need recorded packet history. Endace lists sectors including healthcare, finance, government, telecom, and broadcast.
Verdict
EndaceProbe combines packet recording with centralized search and browser-based analysis across appliance and cloud deployments. Consider the range of listed capacities and the software support coverage when assessing fit.
Plans and prices
From EndaceProbe's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| EndaceProbe | Priced on request | On-premises appliances and cloud deployments; model capacities range from 500 Mbps to 100 Gbps sustained recording |
The facts
Each one read from EndaceProbe's own pages, with the date it was checked.
What it does
- Deployment
- The product is available as physical appliances and as cloud or virtual deployments, including AWS, Microsoft Azure, VMware, KVM, and Nutanix options.checked 4 Oct 2026
- Hosting
- EndaceProbe appliances can host third-party tools, including EndaceFlow for NetFlow, using Application Dock.checked 4 Oct 2026
- Integrations
- Its APIs and Fusion Partner integrations connect packet history to security and performance monitoring tools, including commercial, open-source, and custom applications.checked 4 Oct 2026
- Intended users
- Endace identifies customer sectors including healthcare, retail, banking and finance, military, government, telecom, and broadcast and entertainment.checked 4 Oct 2026
- Investigation
- The browser-based EndaceVision application searches and examines historical packet data and includes Wireshark for packet decoding without downloading large pcaps.checked 4 Oct 2026
- OSm controls
- OSm uses hardened Linux releases, disables shell access, supports Radius, TACACS, and LDAP authentication, and provides role-based access control.checked 4 Oct 2026
- Packet analysis
- EndaceVision is browser-based, and hosted Wireshark can decode packet data on the EndaceProbe without downloading large PCAP files.checked 4 Oct 2026
- Purpose
- EndaceProbe provides continuous full packet capture and recorded network history for investigating security threats, performance issues, and outages.checked 4 Oct 2026
- Recording capacity
- Listed models range from 10 Gb/s to 100 Gb/s sustained recording for hardware appliances, with cloud and vProbe models also listed.checked 4 Oct 2026
- Recording scale
- Listed models range from 500 Mbps to 100 Gbps sustained recording, with listed packet storage from 1 TB to more than 3 PB.checked 4 Oct 2026
- Search and management
- InvestigationManager provides central search and data mining, while EndaceCMS provides central fabric management across physical and cloud probes.checked 4 Oct 2026
- Security
- Endace states that its probes use a cryptographic module for encrypted communications and have FIPS 140-3 validation, Common Criteria NDcPP v2.2e certification, and DoDIN APL listing.checked 4 Oct 2026
- Security certifications
- EndaceProbe models EP-94C8, EP-92C8, EP-2144, and EP-2184 have Common Criteria NDcPP v2.2e certification; Endace also states FIPS 140-3 certification and DoDIN APL listing.checked 4 Oct 2026
- Support
- The Americas support terms list 24×7×365 availability, phone and email support, remote diagnostics, software updates, and a five-minute initial phone response time.checked 4 Oct 2026
- Support limit
- The support terms cover the current and one previous major release of any software product.checked 4 Oct 2026
The company
- Founded
- 2001checked 28 Sep 2026
- Headquarters
- Auckland, New Zealandchecked 28 Sep 2026
Where it runs
- Hosted applications
- EndaceProbe appliances can host third-party tools, including EndaceFlow for NetFlow, using the platform's application hosting capability.checked 4 Oct 2026
Alternatives to EndaceProbe
- 1
Wireshark
Free planOpen sourceAPILinuxmacOSSelf-hosted7.5Free plan - 2
Colasoft Capsa
Free planWindows7.4$295 one-time - 3
Sniffnet
Free planOpen sourceLinuxmacOSWindows7.4Free plan - 4
Arkime
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 5
Avidemux
Free planOpen sourceWebLinuxmacOSWindows7.3Free plan - 6
NetworkMiner
Free planLinuxmacOSWindows6.9$1,300 one-time