NetworkMiner

NetworkMiner turns captured traffic and live sniffing into extracted artifacts and a passive host inventory. It is aimed at incident responders and investigators who need to examine communications and recover files from network captures.

Its free edition covers PCAP and ETL parsing, but PcapNG support and several advanced analysis options require Professional. TLS decryption is not built in, and opening captures can extract malware automatically.

Overview

NetworkMiner extracts files, images, emails and passwords from PCAP traffic, and can sniff live network traffic. It also organizes IP-address details into a host inventory, helping investigators identify assets and review communications between hosts. That combination makes it useful when an investigation needs both recovered artifacts and a view of network participants.

The software runs as a desktop application on Linux, macOS and Windows. Extracted data stays on the end-user device, rather than being sent to a cloud service. Its source is GPLv2 free and open source, written in managed C# on the Microsoft.NET Framework. Netresec says incident response teams, law enforcement, companies and organizations have used it since its first release in 2007.

NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions, though it extracts X.509 certificates. PolarProxy can decrypt traffic and forward it to NetworkMiner, but that requires a separate tool. Treat untrusted PCAPs cautiously: opening them can automatically extract malware, and Netresec recommends Linux or Windows Sandbox to reduce self-infection risk.

Key features

Capture and artifact analysis

The Free Edition handles live sniffing and PCAP/ETL parsing, covering basic capture review without a license fee. It does not parse PcapNG, so teams whose workflows rely on that format need Professional or another tool.

Professional broadens inputs to PCAP, PcapNG and ETL files, Pcap-over-IP, PacketCache data and live sniffing. It also supports file extraction across FTP, TFTP, HTTP, HTTP/2, SMB, SMB2, SMTP, POP3, IMAP and LPR. This is a more capable fit for varied capture sources and protocol-focused investigations, though encrypted TLS payloads remain inaccessible to NetworkMiner itself.

Exports, voice and lookups

Professional exports results as CSV for Excel, JSON-LD and XML, giving teams several formats for further handling. Its VoIP support covers SIP, RTP, G.711 and G.722, including audio extraction from unencrypted calls; encryption is a material limit for anyone seeking call content.

Professional also offers OSINT lookups for file hashes, IP addresses, domain names and URLs, as well as offline IP-to-country and IP ASN lookups. NetworkMinerCLI adds command-line scripting, but it is restricted to the Corporate License.

Pricing

The Free Edition costs nothing. It includes live sniffing and PCAP/ETL parsing on Windows and Linux, but not PcapNG parsing. It is the sensible starting point for basic capture examination, though macOS is supported by the product overall rather than named in this plan.

The Single User License costs $1,300 as a one-time purchase and is valid for three years from purchase. It covers one named employee using the GUI, with free updates and support for three years. It suits an individual investigator who needs Professional's broader formats and analysis but does not need command-line access or organization-wide licensing.

The Corporate License costs $6,500 as a one-time purchase for a perpetual license covering unlimited employees in the registered organization. It includes GUI and command-line applications, with free updates and support during the first year. Organizations needing CLI scripting or broad staff access have a clear reason to choose it; the shorter included support period is worth weighing against the single-user plan's three years.

Professional is not FIPS 140-compliant and requires FIPS enforcement to be disabled on the PC, which may rule it out in environments that require that enforcement.

Platforms

NetworkMiner supports Linux, macOS and Windows as desktop software. The Free Edition plan specifies Windows and Linux, while the paid license terms describe GUI applications without a separate platform list. Capture sources include both files and live traffic, and remote capture is supported.

Who it's for

NetworkMiner is a strong fit for incident response and investigative work where extracting artifacts and building a host inventory are more important than decrypting sessions. Its local data storage also suits teams that want analysis kept on the workstation. It is a poor fit for TLS-content recovery, and untrusted captures should be opened only with the malware risk in mind.

Pros and cons

Pro: Combines artifact extraction with IP-based host inventory, so investigators can connect recovered material with communication context.

Pro: Free PCAP/ETL parsing and live sniffing provide a no-cost entry point for core workflows.

Pro: Professional adds PcapNG, multiple capture sources, broad protocol extraction, structured exports, VoIP analysis and OSINT lookups.

Con: No native TLS decryption means encrypted HTTPS and other TLS sessions cannot yield their protected contents.

Con: PcapNG parsing is excluded from the free edition, while CLI scripting requires the $6,500.00 USD corporate license.

Con: PCAP opening can extract malware, requiring care and potentially an isolated Linux or Windows Sandbox environment.

Con: Professional's lack of FIPS 140 compliance and requirement to disable FIPS enforcement can disqualify it in some managed environments.

Alternatives

Choose Termshark if a free option across Android, Linux, macOS and Windows better matches your platform needs; it requires tshark in PATH, and some tshark features are not exposed.

Malcolm is a free, self-hosted, Apache License 2.0 alternative for readers who want self-hosted software.

Choose Colasoft Capsa if its Windows-only plans suit your needs: Capsa Free limits monitoring to 10 IP addresses, has a 4-hour session timeout and excludes WiFi monitoring; Capsa Professional costs $695, paid once.

Sniffnet is a free, open-source option for Linux, macOS and Windows, licensed under MIT or Apache-2.0.

Arkime is a free, open-source option with no paid-only features or license fees, for Linux and self-hosted or web environments.

For Android, PCAPdroid offers a free core monitoring and capture plan, with paid features sold as a one-time purchase.

tcpdump is a free BSD-licensed alternative; capture permission depends on the operating system and configuration.

TShark is a free alternative from the Wireshark project, maintained by the Wireshark Foundation, a nonprofit supported by donations.

Browse Network Packet Capture Software, Digital Forensics Software, Network Protocol Analyzers and Network Packet Analyzer Software for more options.

Verdict

Choose NetworkMiner when an investigation needs artifact recovery and passive host inventory in one desktop workflow, and Professional's broader capture support justifies its cost. Look elsewhere if native TLS decryption is essential, if FIPS enforcement cannot be disabled, or if PCAP malware risk cannot be managed in an isolated environment.