NetworkMiner

NetworkMiner is desktop software for recovering artifacts from network traffic and building an inventory of communicating hosts. It is most useful to incident responders and investigators working with captures or live traffic who need a local analysis tool. The trade-off is clear: the free edition covers core parsing and sniffing, while paid licenses widen the formats and analysis options without adding native TLS decryption.

Overview

NetworkMiner extracts files, images, emails and passwords from PCAP captures and can sniff live network traffic. It also organizes IP-address details into a host inventory, which helps with passive asset discovery and reviewing communication between hosts. That combination makes it useful for investigation, not just packet inspection.

It is desktop software for Linux, macOS and Windows, and keeps extracted data on the end-user device rather than in the cloud. The source is GPLv2 free and open source, written in managed C# on the Microsoft .NET Framework. Netresec says incident response teams, law enforcement, companies and organizations have used it since its first release in 2007.

NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions, though it can extract X.509 certificates. PolarProxy can decrypt traffic and forward it to NetworkMiner, but that means using a separate tool. There is also a practical safety concern: opening PCAPs can automatically extract malware. Netresec recommends Linux or Windows Sandbox to reduce self-infection risk, so untrusted captures call for an isolated environment.

Key features

Capture and parsing

The Free Edition handles live sniffing and PCAP and ETL parsing, but not PcapNG. That is enough for readers whose work fits those inputs; anyone relying on PcapNG must move to a paid license or another workflow. Professional accepts PCAP, PcapNG and ETL files, Pcap-over-IP, PacketCache data and live sniffing, making it substantially more flexible across capture sources.

Extraction, exports and analysis

Professional adds file extraction across FTP, TFTP, HTTP, HTTP/2, SMB, SMB2, SMTP, POP3, IMAP and LPR. It also supports SIP, RTP, G.711 and G.722 analysis, including audio extraction from unencrypted VoIP calls. For teams that need to carry results into other tools, its CSV, JSON-LD and XML exports are useful additions; OSINT lookups cover file hashes, IP addresses, domain names and URLs, with offline IP-to-country and IP ASN lookups as well.

NetworkMinerCLI adds command-line scripting, but it is restricted to the Corporate License. That makes automation a poor fit for the lower-cost individual license. Professional is also not FIPS 140-compliant and requires FIPS enforcement to be disabled on the PC, which rules it out where that configuration cannot be changed.

Pricing

The free edition is the sensible starting point for individual use when PCAP or ETL and live sniffing are sufficient. At $1,300, paid once, the Single User License is for one employee who needs Professional features in the GUI; its three-year validity is a meaningful limit despite the one-time charge. The $6,500, paid once Corporate License is aimed at organizations needing unlimited employee access or command-line scripting, and its support and updates are included only during the first year. The free edition has no price barrier, but its lack of PcapNG parsing is a material cap for mixed-format work.

Platforms

NetworkMiner is available for Linux, macOS and Windows as desktop software. The Free Edition plan covers Windows and Linux. Extracted data stays on the local device, a good fit for investigations intended to remain on a workstation, but not a cloud-based review process.

Who it's for

Incident responders and investigators who need to pull artifacts from captures, inspect live traffic and maintain a passive host inventory are the strongest fit. Organizations can justify Professional when its wider input formats, protocol extraction, VoIP support, exports or OSINT lookups match their workflow. It is a weaker choice for anyone who needs native TLS decryption, FIPS 140 compliance, or PcapNG support without paying for Professional.

Pros and cons

• Pros: Extracts varied artifacts from PCAPs and supports live sniffing, combining content recovery with host inventory.
• Pros: Professional broadens inputs, exports, protocol extraction, VoIP analysis and OSINT lookups for more involved investigations.
• Pros: Local data storage and GPLv2 source make it suitable for workstation-based, locally controlled analysis.
• Cons: Neither free nor paid NetworkMiner decrypts TLS sessions, so encrypted web traffic remains outside its native analysis.
• Cons: PcapNG parsing, command-line access and several Professional features require a costly paid license.
• Cons: PCAPs can trigger malware extraction, and Professional requires disabling FIPS enforcement on the PC.

Alternatives

Volatility 3 is a free, open-source framework available on Linux, macOS, Windows and self-hosted environments; choose it when that platform mix and framework approach better match the work.

Arkime is free and open source with no paid-only features or license fees, so it is an alternative when avoiding license costs is the priority.

CAINE is a free ISO image of approximately 4000 MB for Linux and Windows; consider it when a forensic distribution is a better fit, keeping in mind that third-party software has separate licenses.

Exterro FTK Imager offers a free Windows-only forensic imaging and preview tool, with a separate FTK Imager Pro plan at $499 a year. Choose it when imaging and preview, rather than network artifact extraction, is the need.

SUMURI PALADIN is a Linux option with a free name-your-price LTS plan, requiring corporate users to donate at least $25, and a $99, paid once PALADIN PRO plan. It may suit readers seeking that Linux-based forensic offering.

Tsurugi Linux provides a free 64-bit Linux distribution as-is without warranty, an option for readers who prefer a Linux distribution.

Paraben E3 Forensic Platform has a free trial and monthly plans starting at $60 a month; it is another option for readers considering a paid forensic platform.

Cellebrite Inseyets is a paid option with a free trial; consider it as an alternative forensic product.

For broader category browsing, see Digital Forensics Software, Network Packet Capture Software, Network Protocol Analyzers and Network Packet Analyzer Software.

Verdict

NetworkMiner is a strong fit for investigators who need local artifact recovery, live sniffing and a host inventory, and its free edition offers a useful route into that work. Choose Professional when its broader inputs and analysis features justify the price and license terms. Look elsewhere if native TLS decryption or FIPS compliance is essential, and isolate the environment before opening untrusted captures.