NetworkMiner is an open source tool for analysing and reporting on network traffic.

The program can work with standard packet capture libraries like WinPcap, or capture raw sockets all on its own. For the most part you don't have to worry about the technical details, though - just point NetworkMiner at the network adapter you'd like it to monitor, click Start, and it'll begin analysing the traffic for you. (Or you can also open regular PCAP files created by other packet sniffers for offline analysis.)

NetworkMiner offers twelve different views on your data, each of which are available via a separate tab, and updated in real time. So if you click on the Hosts tab, say, you can watch new IP addresses appear as they're featured in network traffic, and view a variety of information on each one: MAC address, host name, operating system maybe, TTL, details on packets sent and received, and more.

There are plenty of other low-level details, too, on frames, sessions, DNS traffic and more. And a "Cleartext" view extracts and displays plain text strings found in your TCP and UDP packets.

What makes NetworkMiner more interesting, though, is its ability to reconstruct files that have been streamed across the network, or even via websites like YouTube (the program can extract files whether they've been streamed by FTP, TFTP, HTTP or SMB). And the Images tab is even more straightforward, automatically displaying thumbnails of any images which might have been extracted from your network traffic.

If you like NetworkMiner, but need more power, then you may be interested in the Professional version. This supports port-independent protocol identification, includes Geo IP localisation, host colouring and command line scripting support, and can export its results to CSV files for further analysis elsewhere. It's yours for $900, and you can find out more at the NETRESEC site.

Version 2.1 changes include:
Better email parsing
More encapsulation protocols supported
PacketCache support
HTTP Partial Content / Range Requests