Which tool should you open for a packet capture?

In short

Open a pcap in Wireshark when you need the packet list and a display filter. Use TShark when the same job has to run in a script. Use tcpdump when you are capturing or printing packets on a host. Zeek turns a pcap into protocol logs. Suricata writes events, including TLS names, and can load signatures. NetworkMiner carves files from a pcap; the free edition and the $1,300 Professional build are different. Arkime indexes sessions for a sensor you run; the public demo asked for a Google sign-in. Zui, whose README now titles the app SuperDB Desktop, is the desktop front end for those logs. ntopng is the live traffic dashboard, with a community build and paid licenses on the shop. There is no /compare route. Start with the job, not the logo.