Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

netsniff-ng review

Free#28 of 30 in Network Protocol Analyzers

A capable free Linux CLI toolkit for high-performance local packet capture and PCAP work.

6.3/10Editor score
Visit netsniff-ng
netsniff-ng6.3 Visit netsniff-ng

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

netsniff-ng is a free, open-source networking toolkit for Linux network developers, security practitioners, and administrators. Its utilities cover live packet capture, PCAP file handling, protocol dissection, traffic filtering, flow tracking, tracing, replay, and packet generation. The toolkit is distributed under the GNU GPL version 2.0 and is designed for command-line network diagnostics and analysis on Linux systems.

Performance is a central focus. Zero-copy RX_RING and TX_RING packet processing support high-performance capture and transmission, while kernel-level Berkeley Packet Filter filtering helps narrow traffic at the kernel level. The core utility can capture from Linux network interfaces, read and write PCAP files, replay captures, convert files, and rotate captures by file size or time interval. Built-in dissection covers Ethernet, WLAN, ARP, VLAN, IPv4, IPv6, ICMP, TCP, and UDP. These capabilities make netsniff-ng a strong fit for engineers who need direct control over packet workflows rather than a guided graphical interface.

The broader toolkit adds flow tracking through flowtop, along with packet-generation, tracing, and BPF compilation utilities. That breadth makes it useful when capture, replay, filtering, and flow inspection belong in one Linux-oriented workflow. Its main trade-off is focus: the platform is Linux-only, and live capture is centered on local Linux interfaces. Teams seeking a cross-platform analyzer, remote-host capture workflow, or primarily graphical experience should choose another tool. Linux users who value open-source software, CLI operation, PCAP control, and packet-processing performance should find netsniff-ng a focused option.

netsniff-ng pros and cons

  • Where it wins
    • Zero-copy RX_RING and TX_RING packet processing
    • Captures, reads, replays, converts, and rotates PCAP files
    • Includes BPF filtering, flow tracking, and packet-generation tools
  • Where it doesn't
    • Linux-only platform support
    • Command-line focus may not suit graphical workflows
    • Live capture is centered on local Linux interfaces

netsniff-ng fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update