Free to use. Pro when you need more.
Free forever, or £49.99 a year for the full diagnosis. It's the same download either way: a license key unlocks Pro, with nothing to reinstall.
Free, forever
Genuinely useful on its own - not a crippled trial.
- Full pcapng/pcap parsing and per-packet decode, including QUIC, DHCP, SSH, Kerberos, LDAP, SMB and NTP
- Network health summary, with the worst three of each problem
- A preview of what Pro's detection found in each capture
- Follow stream, devices & services, JA3/JA4 fingerprints
- Batch analysis, file comparison, JSON and CSV exports
- A one-page summary report to print or send on
- 1000 MB upload cap
- 25-item history
Everything, unlocked
Try it free for 14 days. Cancel before the trial ends and you won't be charged. How the trial works
Cancel any time - your instance keeps working as Free if a subscription lapses. Nothing breaks, nothing locks you out.
- Everything in Free, plus:
- Diagnose: full network health, what got worse between two captures, and trends across your history
- Detect: 44 kinds of finding explained in plain English, “first seen” hosts and domains, and your own threat-intel lists
- Report: branded incident reports with an executive summary, and sanitized copies of captures to share
- Automate: watched folder, remote sensors, local alerts, SIEM export and API tokens
- Organise: a title, notes and tags on each capture, searchable and printed in reports
- Multi-user proxy auth mode
- 5120 MB upload cap
- Unlimited history
Full comparison
| Capability | Free | Pro |
|---|---|---|
| Analyse | ||
| pcapng & pcap parsing (timestamp-resolution aware) | ✓ | ✓ |
| Per-packet decode - Ethernet/IPv4/IPv6/ARP, TCP/UDP/ICMP, DNS, HTTP, TLS (incl. certificate details) | ✓ | ✓ |
| QUIC (HTTP/3) - Initial packets decrypted locally for server names, ALPN and fingerprints | ✓ | ✓ |
| DHCP, SSH, Kerberos, LDAP, SMB and NTP decode, with a devices & services view | ✓ | ✓ |
| TLS client fingerprints - JA4 and JA3; SSH HASSH | ✓ | ✓ |
| Aggregate analysis - protocols, talkers, conversations, DNS/HTTP/TLS breakdowns | ✓ | ✓ |
| Follow stream - any TCP or UDP conversation as text or hex, raw bytes to save | ✓ | ✓ |
| Batch analysis (up to 20 files, 4 concurrent) & file comparison | ✓ | ✓ |
| Exports - JSON, multi-sheet CSV | ✓ | ✓ |
| Diagnose | ||
| Network health - DNS response times per resolver, TCP connect times, unanswered connections, retransmissions, HTTP response times and errors | Summary & worst three | Full lists |
| Health comparison - what got worse between two captures | - | ✓ |
| Trends - health and findings across your captures, with the changes worth knowing | - | ✓ |
| Entity timeline - every capture an address or domain appears in | - | ✓ |
| Detect | ||
| 44 kinds of finding, each explained: what it means, when it's harmless, what to check next | Preview | ✓ |
| Authentication & Windows checks - cleartext LDAP binds, SMB1, weak Kerberos tickets, failed-logon bursts, NTP monlist | - | ✓ |
| “First seen” - hosts, domains, certificates and server ports new to your network | - | ✓ |
| Your own IOC lists - IPs, ranges, domains, SHA-256 file hashes, JA3/JA4 and HASSH fingerprints | - | ✓ |
| HTTP objects - files sent or received over HTTP, with SHA-256 hashes and download | - | ✓ |
| Per-finding annotations - confirmed, false positive, under investigation | - | ✓ |
| Re-scan history - apply new rules and IOC lists to past captures, keeping annotations | - | ✓ |
| Report | ||
| Summary report - one page of network health, traffic, and devices and services; self-contained HTML, print to PDF | ✓ | ✓ |
| Incident report - executive summary, findings, notes; self-contained HTML, print to PDF | - | ✓ |
| Report branding - company name, logo, “Prepared by” and a case reference | - | ✓ |
| Shareable copy - a sanitized pcap with payloads stripped and addresses replaced | - | ✓ |
| Per-finding pcap export | - | ✓ |
| Automate | ||
| Watched-folder auto-ingest | - | ✓ |
| Local alerts - in-app inbox and a JSON Lines file, nothing sent anywhere | - | ✓ |
| SIEM export - findings as JSON Lines | - | ✓ |
| API tokens for scripts and CI - read-only, upload only or full, revocable | - | ✓ |
| Remote sensors - Linux and Windows scripts that capture at a site and upload each file with an upload-only token | - | ✓ |
| Capture notes and tags - a title, notes and tags per capture, searchable and printed in reports | - | ✓ |
| Multi-user proxy auth mode | - | ✓ |
| Limits | ||
| Upload size cap | 1000 MB | 5120 MB |
| History retention | 25 items | Unlimited |
| Retention rules - delete captures older than N days, or keep storage under N GB, checked daily | ✓ | ✓ |
Questions
What am I actually licensing?
One license unlocks Pro on one instance at a time - the desktop app on your computer, or a Docker install on your server. Your data stays on it. There's no per-seat counting and no phoning home beyond a periodic license check and a daily check for new versions, which you can turn off.
How can I tell whether Pro is worth it for my network?
Run Free on your own captures first. Every analysis shows a preview of what Pro's detection found: how many findings, and of which kinds. It also shows the network health summary with the worst three problems of each kind. The app includes a synthetic sample capture you can load in one click. This sample incident report is the Pro report for that capture, unedited.
How does the free trial work?
Checkout asks for a card but charges nothing today, and your license key is emailed straight away. Every Pro feature works for the full 14 days. If you keep it, the card is charged £49.99 when the trial ends, and then once a year. To stop, cancel in the customer billing portal any time before the trial ends and you won't be charged at all. Your instance goes back to Free, and your captures and history stay where they are.
What happens if I cancel?
Cancel from the customer billing portal whenever you like. Pro keeps working until the end of the year you've paid for, then your instance drops back to the Free tier automatically - nothing breaks, nothing locks, no data is lost. Resubscribe any time to unlock Pro again.
Refunds?
Your first Pro payment is refunded in full if you ask within 14 days, no questions asked. Renewals aren't automatically refundable, so cancel before the next renewal if you don't want it. Email [email protected] with your license key.
Does my data ever leave my server?
No. Captures are parsed and stored entirely on your own instance. The one exception is license validation - a small periodic check against our license server, containing no capture data. The application sends no usage telemetry or analytics.