NetworkNetwork & Cloud ForensicsNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.Netresec
NetworkMiner
NetworkMiner reads a packet capture and sorts what it finds by host, file, session and credential. It is the tool to open when the question is what happened on the wire rather than which flag was set in which packet.
SoftwareFreemiumCurrentWindows · Linux
Profile
- Manufacturer
- Netresec
- Category
- Network and enterprise
- Product type
- Software
- Platforms
- Windows, Linux
- Licensing
- Freemium
- Product status
- Current
- Educational level
- Intermediate
- Last verified
- 2 November 2026
Two editions: NetworkMiner (free, with source published under the GNU General Public License version 2) and NetworkMiner Professional. The feature split above follows the comparison table on the maker's product page. The maker says macOS use through Mono is very limited, so macOS is not listed as a platform.
What NetworkMiner is
Wireshark shows packets. NetworkMiner shows the things those packets carried. Netresec publishes it in two editions. The free edition is open source under the GNU General Public License version 2 and reads PCAP files or sniffs a live interface, builds an inventory of hosts with an operating system guess taken from the Satori and p0f databases and pulls out files sent over FTP, HTTP, HTTP/2, SMB, SMTP, TFTP and other protocols. It also lists credentials, emails and chat messages, X.509 certificates, JA3, JA3S and JA4 fingerprints and supports keyword search and receiving Pcap-over-IP. The maker says it is built for Windows and can also be used on Linux.
NetworkMiner Professional is the paid edition. The maker's comparison table gives it PcapNG parsing, a network packet carver, port independent protocol identification, user-defined port to protocol mappings, offline IP to country and ASN lookups, OSINT lookups of hashes, addresses and domains, VoIP audio extraction and playback, web browser tracing, advertisement and tracker detection, host colouring, a CIDR filter, a configurable time zone and export to CSV, Excel, XML, CASE and JSON-LD. Command line scripting needs what Netresec calls a corporate licence. In practice an examiner opens the capture, reads the Hosts tab to see who spoke to whom, then the Files tab to see what crossed the network. Only then does Wireshark come out, for the packets that need a closer look.
Primary applications
Where it is used
- First triage of a capture handed over after an incident
- Recovering files and documents that were transferred during a session
- Listing every host in a capture with its sessions and operating system guess
- Recovering credentials sent in the clear during an authorised investigation
- Reconstructing emails and chat messages from the capture
- Exporting structured results in CASE or JSON-LD for other tools (Professional)
Who uses it
- Network forensic analysts
- Incident responders doing first triage
- Security operations analysts
- Students starting network forensics
Capabilities and limits
Major capabilities
- Parses PCAP files and sniffs live traffic, with PcapNG in the Professional edition
- Host inventory with operating system fingerprinting from the Satori and p0f databases
- File extraction from FTP, HTTP, HTTP/2, SMB, SMTP, TFTP and other protocols
- Credential, email, chat and X.509 certificate extraction
- JA3, JA3S and JA4 fingerprints for TLS clients and servers
- Keyword search across the parsed data
- Receives Pcap-over-IP from a remote sensor
- Professional edition adds protocol identification without port numbers, VoIP audio, OSINT lookups, offline geolocation and structured export
Technical limitations
- Encrypted traffic yields certificates and fingerprints, not content
- The free edition cannot open PcapNG captures, which many capture tools now write by default
- File extraction needs the whole stream. A capture that starts in the middle of a transfer gives a partial file
- It decodes far fewer protocols than Wireshark, so unusual traffic still needs a packet-level tool
- macOS use through Mono is described by the maker as very limited
Learning with DFRTI
Independent professional education covering the principles and workflows of NetworkMiner. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- TCP/IP and the common application protocols
- How captures are taken from a tap, span port or sensor
- Hashing and recording of files extracted from a capture
Disciplines
Related tools
- WiresharkWireshark captures network traffic and shows every packet decoded field by field. It is the standard first tool for reading a packet capture in an investigation.Wireshark Foundation
- tcpdump and libpcaptcpdump captures packets from the command line and libpcap is the library it and many other programs use to do it. Between them they define the pcap format that network forensics is built on.The Tcpdump Group
- ZeekZeek watches a network link and writes what it sees as structured logs rather than packets. For a forensic analyst that means hours of traffic become tables that can be searched, joined and placed on a timeline.The Zeek Project
- ArkimeArkime stores packets at scale and indexes the sessions they belong to, so an analyst can search weeks of traffic by field and pull back the exact packets in seconds.Arkime project
Courses that cover this tool
NetworkNetwork & Cloud ForensicsNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.
NetworkNetwork & Cloud ForensicsWireshark / Packet CaptureCapture, filter and read packets in Wireshark and tshark to recover what was sent.
MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.Official source
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.