NetworkMiner

What is NetworkMiner?

NetworkMiner is a network forensic analysis tool (NFAT) developed by Netresec. Its approach differs from Wireshark's: instead of showing you packet by packet, NetworkMiner processes a capture (.pcap or .pcapng) and presents it organized by hosts, files, images, credentials, sessions, DNS and messages. Within seconds you know which machines appear, which operating system they probably run and which files were transferred.

It is a .NET application for Windows that also runs on Linux and macOS with Mono. There is a free edition (the one we link to) and a paid Professional edition with extra features; check the Netresec website for what each includes.

What NetworkMiner is used for

• Incident response: reconstructing what an infected machine downloaded and which servers it talked to.
• File extraction: recovering executables, documents or images transferred over HTTP, FTP, SMB, TFTP and other cleartext protocols.
• Passive inventory: identifying hosts, names, MACs, open ports and OS fingerprints without sending a single packet.
• Cleartext credential detection: spotting usernames and passwords sent over insecure protocols during an authorized audit.
• Forensics CTFs: many challenges are about finding a file or a piece of data inside a pcap.

How to install NetworkMiner

Windows

Download the ZIP from the Netresec website, unzip it and run NetworkMiner.exe. No installation required.

Linux (with Mono)

sudo apt install mono-devel
wget "https://www.netresec.com/?download=NetworkMiner" -O /tmp/nm.zip
sudo unzip /tmp/nm.zip -d /opt/
cd /opt/NetworkMiner*
sudo chmod +x NetworkMiner.exe
sudo chmod -R go+w AssembledFiles/ Captures/
mono NetworkMiner.exe --noupdatecheck

Check the current instructions on the official website, since the folder name includes the version.

Practical NetworkMiner examples

1. Create a capture to analyze

The easiest way is to capture with tcpdump or tshark and open the file afterwards:

sudo tcpdump -i eth0 -w capture.pcap
# or with tshark
sudo tshark -i eth0 -w capture.pcapng

Only capture traffic on your own networks or networks you are explicitly authorized to monitor.

2. Open and review the pcap

1. File → Open and select the capture (or drag it onto the window).
2. Hosts tab: expand each IP to see the estimated OS, hostnames, ports and sessions.
3. Files tab: lists reassembled files; they are saved in the AssembledFiles folder.
4. Images tab: thumbnails of transferred images.
5. Credentials tab: credentials and cookies found in cleartext protocols.
6. DNS tab: every resolution, very useful to spot malicious domains.

3. Verify a suspicious file

Once extracted, compute its hash and compare it with your intelligence sources:

find AssembledFiles -type f -name "*.exe" -exec sha256sum {} \;

Pro tips

• Use NetworkMiner for the big picture and Wireshark for the details of a specific stream: they complement each other.
• HTTPS traffic cannot be reassembled without the keys; you will still see SNI names and certificates.
• Very large pcaps can slow down the UI: split them first with editcap or filter them with tcpdump -r.
• Use the Keywords tab to search for specific strings across all traffic.
• Only open extracted files on an isolated analysis machine: they may be malware.

NetworkMiner pros and cons

Pros	Cons
Very useful free edition	Some features only in the Professional edition
Automatic file and image extraction	Built for Windows; needs Mono on Linux
Host-centric view, ideal for incidents	Doesn't replace Wireshark for protocol details
Passive OS fingerprinting	Limited performance on very large captures

NetworkMiner alternatives

• Wireshark: the reference protocol analyzer; its Export Objects option also extracts files.
• Binwalk: to analyze the files and firmware you extract.
• CyberChef: to decode Base64, hex or compressed payloads found in traffic.
• OpenCTI: to correlate the IPs and domains you find with threat intelligence.

Frequently asked questions

Is NetworkMiner free?

Yes, the free edition of NetworkMiner can be used at no cost. There is also a paid Professional edition; check its current price on the Netresec website.

What is the difference between NetworkMiner and Wireshark?

Wireshark shows packets and protocols in detail; NetworkMiner groups information by host and automatically extracts files and credentials. For forensics, the ideal is to use both.

Is NetworkMiner legal?

Analyzing captures is legal. Capturing traffic on other people's networks without authorization is not. Use it on your own network, in labs or in audits with written permission.

How do I use NetworkMiner with a pcap?

Open the file with File → Open and go through the Hosts, Files, Credentials and DNS tabs. Extracted files end up in the AssembledFiles folder.

If you want to practice network forensics with real captures and guided challenges, visit the Hackers en Acción Academy.