NetworkMiner

NetworkMiner analyzes captured network traffic and can sniff live traffic, extracting artifacts such as files, images, emails, and passwords from PCAP files. It builds a host inventory from IP address information for passive asset discovery and communication overviews. The free edition supports live sniffing and PCAP and ETL parsing on Windows and Linux, but it does not parse PcapNG. NetworkMiner Professional accepts additional inputs including PcapNG, Pcap-over-IP, and PacketCache data, and exports results to CSV, JSON-LD, and XML. Its protocol analysis includes file extraction across listed protocols, while Professional also supports VoIP audio extraction and OSINT lookups. NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions. Extracted data is stored locally on the user's device rather than in the cloud. The source code is released under GPLv2 as free and open source software. Netresec warns that opening PCAP files can automatically extract malware and recommends Linux or Windows Sandbox to reduce self-infection risk. The Single User License costs $1,300, paid once and is valid for three years from purchase.

NetworkMiner combines traffic artifact extraction with host inventory and live sniffing. Note its PcapNG limitation in the free edition, and follow the maker's malware safety guidance when opening captures.

NetworkMiner suits incident response, law enforcement, and other users who need to inspect captured traffic or sniff live traffic. The free edition may suit users working with PCAP or ETL files on Windows or Linux.

Overview

NetworkMiner is a desktop tool for examining captured network traffic and sniffing live traffic. It is best suited to responders and investigators who need extracted artifacts alongside a passive view of network hosts. Its appeal is focused forensic analysis; its boundaries include no native TLS decryption and no PcapNG parsing in the free edition.

Key features

Artifacts and host inventory

NetworkMiner extracts files, images, emails and passwords from PCAP traffic, then organizes IP-address details into a host inventory. That combination helps investigators connect recovered artifacts with assets and communication patterns, rather than treating packet review as the only task. It is also useful for passive asset discovery, though it is not a substitute for decrypting encrypted sessions.

Capture formats and protocol coverage

The free edition supports live sniffing and PCAP and ETL parsing, but not PcapNG. Professional accepts PCAP, PcapNG and ETL files, Pcap-over-IP, PacketCache data and live traffic. For protocol-specific extraction, Professional covers FTP, TFTP, HTTP, HTTP/2, SMB, SMB2, SMTP, POP3, IMAP and LPR. That broader input and protocol coverage makes the paid edition the more capable choice for varied evidence sources; users working only with supported free-edition inputs may have less reason to pay.

Exports, lookups and VoIP

Professional exports results as CSV, JSON-LD and XML. It also offers OSINT lookups for file hashes, IP addresses, domain names and URLs, plus offline IP-to-country and IP ASN lookups. VoIP support includes SIP, RTP, G.711 and G.722, with audio extraction from unencrypted calls. These features can add useful context to an investigation, but they do not extend to audio hidden by encryption.

Encryption and safe handling

NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions. It can extract X.509 certificates, and PolarProxy can decrypt traffic and forward it to NetworkMiner, but that requires a separate tool. Extracted data stays on the end-user device rather than in the cloud. Because opening a PCAP can automatically extract malware, Netresec recommends Linux or Windows Sandbox to reduce the risk of infecting the analysis machine.

Pricing

The Free Edition costs nothing. It includes live sniffing and PCAP/ETL parsing on Windows and Linux, but omits PcapNG parsing. It is a practical starting point for users whose captures fit those formats; it does not cover every Professional input.

The Single User License costs $1,300, paid once. It covers one named employee using the GUI application, with a license valid for three years from purchase and free updates and support for those three years. This fits an individual investigator who needs Professional capabilities, but the three-year term and single-user restriction matter for ongoing or shared use.

The Corporate License costs $6,500, paid once and is perpetual for unlimited employees in the registered organization. It includes GUI and command-line applications, with free updates and support during the first year. It is the fit for organization-wide use or command-line scripting through NetworkMinerCLI; teams should account for the fact that updates and support are included only in year one. NetworkMiner Professional is not FIPS 140-compliant and requires FIPS enforcement to be disabled on the PC.

Platforms

NetworkMiner is available for Linux, macOS and Windows. It is desktop software, with both file-based capture analysis and live capture support. The free plan's stated platform coverage is Windows and Linux.

Who it's for

NetworkMiner suits incident responders, law enforcement, and organizations that need to recover artifacts from network traffic and build a passive inventory of communicating hosts. Its managed C# source is released under GPLv2, and the software has been used by these kinds of users since its first release in 2007. It is a weaker fit when TLS decryption is essential, when PcapNG must be parsed without paying, or when captures cannot be opened safely in an isolated environment.

Pros and cons

• Artifact extraction and host inventory in one desktop workflow: recovered files and other artifacts sit alongside IP-based host and communication context.
• Useful Professional breadth: PcapNG, multiple capture sources, structured exports, OSINT lookups and unencrypted VoIP audio extraction cover needs beyond basic PCAP parsing.
• Local data handling: extracted data remains on the user's device rather than being sent to a cloud service.
• Free-edition format gap: lack of PcapNG parsing can rule it out for users who need that format without a paid license.
• No TLS decryption: encrypted HTTPS and other TLS sessions remain unreadable without a separate decryption workflow.
• Capture safety requires care: automatic malware extraction makes sandboxing or Linux use important when handling untrusted PCAPs.

Alternatives

Choose termshark if a free, MIT-licensed option that requires tshark 1.10.2 or higher better fits your needs. Choose Colasoft Capsa if you want a Windows alternative with a free tier limited to 10 monitored IP addresses and four-hour sessions, or a paid Professional plan at $695, paid once. Choose Scapy if you prefer a free GPLv2 tool requiring Python 3.7 or later. Choose Arkime if you want an open-source option with no paid-only features or license fees. Choose EtherApe for a free, open-source Linux option. Choose Ettercap for a free open-source project with source code downloads. Choose Kismet for a free and open-source option with no paid plan or usage limit stated. Choose NETCAP if a free-forever open-source CLI with 66+ audit record types and community support suits the task.

For broader browsing, see Network Protocol Analyzers, Network Packet Capture Software, Network Packet Analyzer Software and Digital Forensics Software.

Verdict

NetworkMiner is a strong choice for investigators who want artifact extraction, host inventory and live sniffing in a desktop tool, especially when Professional's wider formats and exports justify its cost. Look elsewhere if native TLS decryption or free PcapNG parsing is essential, and isolate untrusted captures to manage the malware risk.