NetworkMiner: A Practical Guide to Network Forensics
NetworkMiner is a network forensic analysis tool designed to help investigators examine traffic captured from a network. Rather than focusing primarily on displaying individual packets, it organises captured data into useful information about hosts, connections and transferred files. This can make it easier to investigate what happened during a network incident.
What is NetworkMiner?
Developed by Netresec, NetworkMiner is used to analyse packet capture files, commonly known as PCAP files. It can identify hosts and network sessions, and may extract artefacts such as files, images, certificates and credentials when they are present in supported traffic. The results depend on the protocols used, the quality of the capture and whether the relevant information is visible.
NetworkMiner is often described as a passive network forensic analysis tool. It examines traffic that has already been captured, rather than actively interacting with the systems being investigated. This makes it useful for reviewing a saved capture after a security alert or suspected intrusion.
What can NetworkMiner help with?
- Host identification: View systems observed in the capture and details that may help distinguish them.
- Session analysis: Review communications between hosts and the services involved.
- File extraction: Recover files transferred in supported protocols, where the capture contains enough data.
- Artefact review: Examine other available evidence, such as images, certificates or credentials exposed in unencrypted traffic.
- Incident investigation: Build a clearer picture of network activity for security monitoring, troubleshooting or digital forensics.
How does it fit into an investigation?
A typical workflow begins with collecting network traffic using an authorised capture process. The resulting PCAP file can then be opened in NetworkMiner for an initial overview of hosts, sessions and potential artefacts. Investigators can use those findings to decide which traffic needs closer examination.
NetworkMiner can complement packet analysers such as Wireshark. Its host-centred presentation and artefact extraction can make certain investigative tasks quicker, while a packet analyser offers detailed control over individual packets and protocol fields. The tools serve related but different purposes, so using them together can be helpful.
Important limitations
NetworkMiner can only analyse information available in the capture. If traffic was missed, the capture began too late, or the relevant content is encrypted, the tool may not be able to recover the details an investigator is looking for. Modern encryption often prevents the contents of a connection from being read, although some connection metadata may still be visible.
Results also need to be interpreted carefully. An extracted artefact or identified host is evidence to investigate, not necessarily proof of malicious activity on its own. Good practice includes preserving the original capture, documenting how it was obtained, recording analysis steps and corroborating findings with other evidence.
Choosing a version
NetworkMiner is available in different editions, including a free Community Edition and a commercial Professional Edition. Features and licensing can change, so check the developer’s website for current details before choosing a version. Organisations should also review the licence terms and test the software with representative captures before relying on it in operational workflows.
Use it responsibly
Network captures can contain sensitive information, including personal data and confidential business communications. Only capture or analyse traffic when authorised, follow applicable privacy and data-protection requirements, and restrict access to capture files and extracted artefacts.
Conclusion
NetworkMiner is a useful option for turning packet captures into an organised view of network activity. Its ability to group information around hosts and identify recoverable artefacts can support incident response and forensic investigations. Like any analysis tool, it works best when used alongside sound evidence-handling practices and a clear understanding of what the capture can—and cannot—show.
8 Tips for Safe and Effective Network Analysis with NetworkMiner
- Use NetworkMiner to analyse PCAP files without altering the original capture.
- Capture only traffic you are authorised to inspect.
- Check the Hosts tab to identify systems and their network activity.
- Review the Files tab to recover files observed in the capture.
- Use the DNS tab to spot queried domains and potential anomalies.
- Treat extracted credentials as sensitive and store them securely.
- Compare findings with other tools before drawing conclusions.
- Keep captures and reports protected, as they may contain personal data.
Use NetworkMiner to analyse PCAP files without altering the original capture.
Use NetworkMiner to examine PCAP files while keeping the original capture intact. Analyse a working copy where possible, store the source file securely and record the steps taken during your investigation. This helps preserve the evidence for later review and makes your findings easier to verify.
Capture only traffic you are authorised to inspect.
Capture only traffic you are authorised to inspect. NetworkMiner can reveal sensitive details from network traffic, so only collect or analyse data when you have clear permission to do so. Follow your organisation’s policies and applicable privacy and data-protection requirements, and store capture files securely with access limited to authorised people.
Check the Hosts tab to identify systems and their network activity.
Check the Hosts tab in NetworkMiner to see which systems appear in the capture and review their associated network activity. This can help you quickly identify relevant devices, understand which hosts communicated and decide where to focus your investigation. Remember that the information shown depends on the traffic captured, so treat it as a starting point and verify important findings against the underlying evidence.
Review the Files tab to recover files observed in the capture.
Review the Files tab in NetworkMiner to see files identified in the network capture. Where the traffic contains enough data and the transfer uses a supported protocol, you may be able to recover files for further analysis. Check the file details and related session carefully, and remember that encrypted, incomplete or unsupported traffic may prevent recovery.
Use the DNS tab to spot queried domains and potential anomalies.
Use NetworkMiner’s DNS tab to review the domains queried in a capture and spot anything that looks out of place. Unfamiliar or misspelt domain names, unexpected top-level domains, or repeated queries to a single host may warrant closer investigation. Treat these as clues rather than proof of malicious activity, and check them against the surrounding traffic and other available evidence.
Treat extracted credentials as sensitive and store them securely.
Treat any credentials extracted with NetworkMiner as highly sensitive information. They may provide access to user accounts, systems or services, so avoid sharing them unnecessarily and never include them in reports or screenshots without appropriate redaction. Store them only in an approved, access-controlled location, protect them with encryption where possible, and follow your organisation’s retention and disposal policies. If a credential may have been exposed or compromised, notify the relevant security team and arrange for it to be changed.
Compare findings with other tools before drawing conclusions.
Compare NetworkMiner’s findings with evidence from other tools before drawing conclusions. Cross-check hosts, sessions and extracted artefacts against packet-level analysis in tools such as Wireshark, as well as relevant logs and endpoint data. This can help confirm that an observation is accurate, provide useful context and reduce the risk of treating an incomplete or misleading result as proof of malicious activity.
Keep captures and reports protected, as they may contain personal data.
Network captures and reports can contain personal data, credentials and details of private communications, so treat them as sensitive information. Store them in access-controlled locations, share them only with authorised people and use encryption where appropriate. Keep them only for as long as necessary, following your organisation’s retention and data-protection policies, and securely delete them when they are no longer needed.