netsniff-ng
netsniff-ng is a free, open-source Linux network analyzer and toolkit for network development, debugging, analysis, auditing, and reconnaissance.
What netsniff-ng is
netsniff-ng is a free, open-source Linux network analyzer and toolkit for network development, debugging, analysis, auditing, and reconnaissance. It captures, analyzes, replays, and redirects traffic using zero-copy packet mechanisms, with live and command-line capture as well as offline trace analysis. It reads and writes tcpdump-capable pcap, including nanosecond-resolution pcap, Alexey Kuznetzov's pcap, and netsniff-ng pcap; its capture files interoperate with other packet-analysis tools. Filtering includes low- and high-level options, including Berkeley Packet Filter expressions. The built-in dissector covers Ethernet, WLAN, ARP, MPLS, VLAN, LLDP, IPv4, IPv6, ICMP, IGMP, TCP, and UDP. The toolkit also includes trafgen, mausezahn, ifpps, curvetun, astraceroute, flowtop, and bpfc. Mausezahn and curvetun are marked experimental and not recommended for production use. It is licensed under GNU GPL 2.0. The project provides release-verification instructions and directs questions to its mailing list and FAQ, while noting that it does not guarantee the tools are bug-free.
Good
- Free and open source under GNU GPL 2.0
- Supports live capture and offline trace analysis
- Reads and writes several pcap formats
- Includes a dissector for common network protocols
Watch out
- Available for Linux only
- Mausezahn and curvetun are experimental
- Project provides no guarantee against bugs
Who it suits
It suits Linux users who need packet capture, filtering, and offline trace analysis for network work. Those considering mausezahn or curvetun should note their experimental status and production-use warning.
Verdict
netsniff-ng brings capture, filtering, trace analysis, and related utilities into a free Linux toolkit. Its experimental components and lack of a bug-free guarantee are worth considering before use.
Plans and prices
From netsniff-ng's own pricing page, checked 7 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| netsniff-ng toolkit | Free | Free, open-source toolkit under GNU GPL 2.0 |
The facts
Each one read from netsniff-ng's own pages, with the date it was checked.
What it does
- Capture formats
- It captures and reads pcap files that interoperate with other packet-analysis tools.checked 7 Oct 2026
- Experimental utilities
- The project marks mausezahn and curvetun as experimental and advises against using them in production.checked 7 Oct 2026
- Filtering
- netsniff-ng supports low-level and high-level packet filters, including Berkeley Packet Filter expressions.checked 7 Oct 2026
- License
- The toolkit is open source under the GNU General Public License version 2.0.checked 7 Oct 2026
- Limitations
- The project says it provides no guarantee that its tools are free of bugs.checked 7 Oct 2026
- Packet capture
- netsniff-ng captures, analyzes, replays, and redirects network traffic using zero-copy packet mechanisms.checked 7 Oct 2026
- Protocol analysis
- Its built-in dissector supports Ethernet, WLAN, ARP, MPLS, VLAN, LLDP, IPv4, IPv6, ICMP, IGMP, TCP, and UDP.checked 7 Oct 2026
- Purpose
- netsniff-ng is a free Linux network analyzer and networking toolkit for network development, debugging, analysis, auditing, and reconnaissance.checked 7 Oct 2026
- Release verification
- The project provides instructions for verifying releases using Git tags and GPG signatures.checked 7 Oct 2026
- Support
- The project directs users to its mailing list and online FAQ for questions and feedback.checked 7 Oct 2026
- Toolkit components
- The toolkit includes netsniff-ng, trafgen, mausezahn, ifpps, curvetun, astraceroute, flowtop, and bpfc.checked 7 Oct 2026
Where it runs
- Platforms
- The toolkit supports Linux operating systems with CONFIG_PACKET_MMAP enabled; its FAQ recommends a kernel version of 2.6.31 or newer.checked 7 Oct 2026
Alternatives to netsniff-ng
- 1
Wireshark
Free planOpen sourceAPILinuxmacOSSelf-hosted7.5Free plan - 2
Colasoft Capsa
Free planWindows7.4$295 one-time - 3
Sniffnet
Free planOpen sourceLinuxmacOSWindows7.4Free plan - 4

Arkime
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 5
Avidemux
Free planOpen sourceWebLinuxmacOSWindows7.3Free plan - 6

NetworkMiner
Free planLinuxmacOSWindows6.9$1,300 one-time