> I also like Network Miner for reassembling HTTP traffic
> (http://www.netresec.com/?page=NetworkMiner). Unfortunately you can only
> import .pcap files right now (not .pcapng).
Yes, but you can now load PcapNG files with CapLoader [
http://www.caploader.com ] and export your desired flows directly to
NetworkMiner (or Wireshark). This works great, and the trial is free
to download (no registration required).
Another alternative is to convert pcapng to pcap by submitting it to
http://pcapng.com
/erik
--
blog: http://www.netresec.com/?page=Blog
twitter: http://twitter.com/netresec
