Compare products

Put two or three cybersecurity products side by side and see how they differ on deployment, pricing, features, integrations and compliance.

Corelight InvestigatorTcpdump2 of 3 products

Side-by-side comparison of Corelight Investigator, Tcpdump
Product	Corelight Investigator by Corelight View product	Tcpdump by Tcpdump View product
Overview
What it is	Looking for Network Security software? Corelight Investigator by Corelight provides entity tracking for Incident Investigation. Compare features and alternatives.	Tcpdump: real-time packet capture, Berkeley Packet Filter syntax and PCAP file format export. Built for BPF packet filtering. Compare Network Security alternatives.
Product type	Cloud-Native Network Detection and Response (NDR)	Command-Line Network Packet Analyzer & Capture Utility
Best for	Enterprise Security Operations, Banking, Tech, Healthcare, Public	Network Engineering, Cybersecurity, System Administration, DevOps, Education
Pricing
Pricing model	Contact Vendor	Contact Vendor
Free trial	Free trial: yes	Free trial: yes
Deployment
Deployment options	SaaSCloud	Cloud
Deployment details	Cloud (SaaS); Sensor-Backed Analytics; Cloud SaaS; Sensor-backed network analytics	Open Source; CLI Tool; Open Source Command-Line Binary (Natively Included in Unix/Linux)
Data residency	US; EU; Global	Local Host System Only (Zero Remote Cloud Telemetry)
Key features
What it offers	Cloud-native NDR Zeek network telemetry MITRE ATT&CK threat detections Entity tracking Rapid network query pivots NDR Network Security Threat Detection	Real-time packet capture Berkeley Packet Filter (BPF) syntax PCAP file format export Protocol header decoding Terminal command-line interface Command-line packet capture Network troubleshooting Security incident traffic investigation
Platform & access
API access	API access: yes	API access: no
Single sign-on (SSO)	SSO: yes	SSO: no
Role-based access (RBAC)	RBAC: yes	RBAC: yes
Multi-tenant	Multi-tenant: yes	Multi-tenant: no
Mobile app	Mobile app: no	Mobile app: no
Supported platforms	Corelight SensorsAWSAzureGCPOn-premises Networks	LinuxUnixmacOS Network InterfacesCloud VMsNetwork Switches
Compliance	SOC 2 Type IIISO 27001GDPRHIPAA	BSD 3-Clause LicenseCommon CriteriaNetwork Standards
Integrations & coverage
Integrations	Corelight SensorsCrowdStrike FalconMicrosoft SentinelSplunk	libpcapWiresharkSnortSuricataLinux TerminalNetwork Interfaces
Industries	Enterprise Security OperationsBankingTechHealthcarePublic	Network EngineeringCybersecuritySystem AdministrationDevOpsEducation
Regions	GlobalUSEU	Global
Vendor
Company	Corelight	Tcpdump
Headquarters	San Francisco, California, USA	Open Source Project
Company size	201-500	1-10
Founded	2013	1988

Corelight Investigator

by Corelight

View product

Tcpdump

by Tcpdump

View product

Overview

What it is

Corelight Investigator

Looking for Network Security software? Corelight Investigator by Corelight provides entity tracking for Incident Investigation. Compare features and alternatives.

Tcpdump

Tcpdump: real-time packet capture, Berkeley Packet Filter syntax and PCAP file format export. Built for BPF packet filtering. Compare Network Security alternatives.

Product type

Corelight Investigator

Cloud-Native Network Detection and Response (NDR)

Tcpdump

Command-Line Network Packet Analyzer & Capture Utility

Best for

Corelight Investigator

Enterprise Security Operations, Banking, Tech, Healthcare, Public

Tcpdump

Network Engineering, Cybersecurity, System Administration, DevOps, Education

Pricing

Pricing model

Corelight Investigator

Contact Vendor

Tcpdump

Contact Vendor

Free trial

Corelight Investigator

Tcpdump

Deployment

Deployment options

Corelight Investigator

SaaSCloud

Tcpdump

Cloud

Deployment details

Corelight Investigator

Cloud (SaaS); Sensor-Backed Analytics; Cloud SaaS; Sensor-backed network analytics

Tcpdump

Open Source; CLI Tool; Open Source Command-Line Binary (Natively Included in Unix/Linux)

Data residency

Corelight Investigator

US; EU; Global

Tcpdump

Local Host System Only (Zero Remote Cloud Telemetry)

Key features

What it offers

Corelight Investigator

Cloud-native NDR
Zeek network telemetry
MITRE ATT&CK threat detections
Entity tracking
Rapid network query pivots
NDR
Network Security
Threat Detection

Tcpdump

Real-time packet capture
Berkeley Packet Filter (BPF) syntax
PCAP file format export
Protocol header decoding
Terminal command-line interface
Command-line packet capture
Network troubleshooting
Security incident traffic investigation

Platform & access

API access

Corelight Investigator

Tcpdump

Single sign-on (SSO)

Corelight Investigator

Tcpdump

Role-based access (RBAC)

Corelight Investigator

Tcpdump

Multi-tenant

Corelight Investigator

Tcpdump

Mobile app

Corelight Investigator

Tcpdump

Supported platforms

Corelight Investigator

Corelight SensorsAWSAzureGCPOn-premises Networks

Tcpdump

LinuxUnixmacOS Network InterfacesCloud VMsNetwork Switches

Compliance

Corelight Investigator

SOC 2 Type IIISO 27001GDPRHIPAA

Tcpdump

BSD 3-Clause LicenseCommon CriteriaNetwork Standards

Integrations & coverage

Integrations

Corelight Investigator

Corelight SensorsCrowdStrike FalconMicrosoft SentinelSplunk

Tcpdump

libpcapWiresharkSnortSuricataLinux TerminalNetwork Interfaces

Industries

Corelight Investigator

Enterprise Security OperationsBankingTechHealthcarePublic

Tcpdump

Network EngineeringCybersecuritySystem AdministrationDevOpsEducation

Regions

Corelight Investigator

GlobalUSEU

Tcpdump

Global

Vendor

Company

Corelight Investigator

Corelight

Tcpdump

Headquarters

Corelight Investigator

San Francisco, California, USA

Tcpdump

Open Source Project

Company size

Corelight Investigator

201-500

Tcpdump

1-10

Founded

Corelight Investigator

2013

Tcpdump

1988