Perform unprecedented free-form contextual analysis of raw network data. NNetWitness Investigator is the award-winning interactive threat analysis software of the NetWitness NextGen product suite. Investigator provides security operations staff, auditors, and fraud and forensics investigators the power to perform unprecedented free-form contextual analysis of raw network data captured and reconstructed by the NetWitness NextGen infrastructure.

Developed originally for the U.S. Intelligence Community, and now used extensively by Law Enforcement, Defense, and other public and private organizations, Investigator is based upon 10 years of development and deployment in some of the most demanding and complex threat environments.

With its groundbreaking user interface and unprecedented analytics, Investigator lets you see your network traffic in a new way. Unlike packet analysis products products which display network traffic in the context of confusing network nomenclature, Investigator uses a lexicon of nouns, verbs and adjectives – characteristics of the actual software and logic layer protocols parsed by NextGen during session reconstruction.
Both novice and expert users can use Investigator to pivot terabytes of network traffic easily to dive deeply into the context and content of network sessions in real-time -- making threat analysis that once took days, take only minutes. It is this intersection of network metrics, rich software flow, and content information that differentiates NetWitness products from any other ability on the market today.

In addition to the rich data Investigator receives from the NextGen infrastructure of NetWitness Decoders and Concentrators, Investigator Enterprise can locally capture live traffic and process packet files from virtually any existing network collection device for quick and easy analysis.

NetWitness Investigator Features:
1. Extensive network and software layer filtering (e.g. MAC, IP, User, Keywords, Etc.)
2. IPv6 support
3. Captures live from any wired or wireless interface
4. Full content search, with Regex support
5. Exports data in .pcap format
6. Imports packets from any open-source, home-grown and commercial packet capture system(e.g. .pcap file import)
7. Bookmarking & History Tracking
8. Integrated GeoIP for resolving IP addresses to city/county, supporting Google Earth visualization
9. Customizable right-click functionality
10. Supports WLAN 802.11 Microsoft, Linux and Mac OS radio devices as well as various header formats including CACE's per packet information
11. Supports RSA SecurID and LDAP authentication
12. Supports NetWitness Live
13. SSL Decryption (with server certificate)
14. Interactive time charts, and summary view
15. Interactive packet view and decode
16. Hash Pcap on Export
17. Enhanced content views
18. Real-time, Patented Layer 7 Analytics
- Effectively analyze data starting from software layer entities like users, email, address, files , and actions.
- Infinite, free-form analysis paths
- Content starting points
- Patented port agnostic service identification

With Investigator you are provided with a full-featured, stand-alone product capable of local live capture and local packet file importing. Ideal for tactical and point analysis of network traffic. Supports 25 simultaneous 1GB captures - far exceeding data manipulation abilities of packet tools like Wireshark.

NetWitness Investigator is licensed per computer host, and can be used to locally process packet files, collect live from a network tap or span port with insight into network traffic of your choice. In addition, Investigator is fully integrated with all NetWitness NextGen products.

The license of this software is Freeware, you can free download and free use this network monitoring software.