NetworkMiner is a Network Forensic Analysis Tool (NFAT) created by Netresec. Unlike Wireshark, Tshark, or tcpdump, which present traffic as a chronological list of individual packets, NetworkMiner takes a host-centric and artifact-centric approach: it passively parses a capture file (or sniffs live traffic) and automatically reconstructs the meaningful objects hidden inside the traffic — files transferred over HTTP/FTP/SMB, images, credentials sent in cleartext, DNS names, session cookies, certificates, and detailed host profiles (operating system, open ports, hostnames) — without requiring the analyst to actively hunt through packets one by one.
NetworkMiner was originally written for Windows (.NET Framework) but runs on Linux, including Kali Linux, via Mono. It has both a free/open-source Community Edition and a paid Professional Edition with additional features (such as geolocation, port-independent protocol identification for more protocols, and case management). The Community Edition, which is what ships with Kali, is more than sufficient for most forensic and CTF-style analysis tasks.
NetworkMiner is widely used in incident response to quickly answer questions like “what files were downloaded during this attack?”, “were any credentials sent in the clear?”, and “what hosts were talking to each other and what operating systems were they running?” — all directly from a pcap file, without manual packet-by-packet inspection.
How to Install
NetworkMiner is available in the Kali Linux repositories and depends on Mono to run its .NET-based GUI:
# Update package lists
sudo apt update
# Install Mono runtime (required dependency) and NetworkMiner
sudo apt install mono-complete -y
sudo apt install networkminer -y
If NetworkMiner is not available directly via apt on your Kali version, install manually from Netresec:
cd /opt
sudo wget https://www.netresec.com/?download=NetworkMiner -O NetworkMiner.zip
sudo unzip NetworkMiner.zip
cd NetworkMiner_*/
sudo chmod +x NetworkMiner.exe
# Fix executable and script permissions per the included README
sudo chmod +x NetworkMiner.sh 2>/dev/null
Verify Mono is correctly installed:
mono --version
Expected output:
Mono JIT compiler version 6.12.0.200 (tarball Wed Jan 1 00:00:00 UTC 2024)
Copyright (C) 2002-2014 Novell, Inc, Xamarin Inc and Contributors.
Launch NetworkMiner (requires a graphical session):
sudo mono /opt/NetworkMiner_2-8/NetworkMiner.exe
Or, if installed via apt with a wrapper script:
sudo networkminer
Syntax
NetworkMiner is primarily a GUI tool; it does not have an extensive scriptable CLI like tcpdump or tshark. It is launched, and files or interfaces are chosen from within the GUI:
mono NetworkMiner.exe [pcap file]
Examples:
sudo mono NetworkMiner.exe # Launch GUI empty
sudo mono NetworkMiner.exe capture.pcap # Launch and load a pcap directly
Live sniffing requires selecting an interface inside the GUI (File -> Select Interface -> Start).
All Command-Line Options (Kali Linux)
NetworkMiner’s command-line surface is minimal since it is GUI-driven; the executable primarily accepts a single optional argument (an input capture file) at launch. There is no dedicated flag-based CLI equivalent to tcpdump/tshark. The GUI itself exposes its full functionality through menus and tabs rather than switches:
Usage:
NetworkMiner.exe [pcap-file]
Arguments:
pcap-file Optional. Path to a .pcap/.pcapng/.cap file to load
automatically when the GUI starts.
GUI Menu Equivalents (accessed after launch):
File -> Open Load a capture file
File -> Select Interface Choose a live NIC for passive sniffing
File -> Receive PCAP over IP Ingest a stream sent from a remote sensor
Tools -> Options Configure output/temp directories, ports
Case Panel Manage multiple loaded capture files as one "case"
Key functional tabs inside the GUI (not CLI flags, but the core “commands” of the tool):
Hosts - List of all detected hosts with OS fingerprint, MAC, hostname
Files - All files reconstructed/carved from traffic
Images - All image files extracted, shown as thumbnails
Messages - Extracted emails, chat messages
Credentials - Extracted usernames/passwords sent in cleartext protocols
Sessions - Reconstructed TCP/UDP sessions
DNS - All resolved DNS queries/responses
Parameters - Extracted HTTP/URL parameters
Keywords - Custom keyword search across all reconstructed content
Anomalies - Detected anomalies (e.g., malformed packets)
Basic Usage (Expected Output in Bash)
Launching NetworkMiner from the terminal:
sudo mono /opt/NetworkMiner_2-8/NetworkMiner.exe
Expected terminal output:
[MainForm] Loading NetworkMiner GUI...
[MainForm] Initializing packet parsers...
(GUI window opens; no further structured stdout is produced during normal use,
since NetworkMiner is a graphical application)
Loading a capture file directly from the command line:
sudo mono /opt/NetworkMiner_2-8/NetworkMiner.exe /home/kali/captures/incident.pcap
Expected behavior:
(GUI opens with incident.pcap already parsed; the Hosts, Files, Images,
Credentials, and Sessions tabs are automatically populated based on the
contents of the file.)
Practical Examples with Output
Example 1: Load a pcap and review discovered hosts
sudo mono NetworkMiner.exe capture.pcap
Hosts tab (representative table):
Host IP Address MAC Address OS Hostname
Host 1 192.168.1.10 aa:bb:cc:11:22:33 Windows 10 DESKTOP-ABC123
Host 2 93.184.216.34 (remote) Linux 3.x/4.x example.com
Host 3 192.168.1.1 aa:bb:cc:99:88:77 Linux (router) gateway.local
Example 2: Extract files transferred over HTTP
Files tab (auto-populated after loading capture.pcap)
Output:
Frame Filename Size Source Host Destination Host Protocol
102 invoice.pdf 245 KB 93.184.216.34 192.168.1.10 HTTP
188 update.exe 1.2 MB 151.101.1.69 192.168.1.10 HTTP
Example 3: View extracted images
Images tab
Output:
(Grid of thumbnail images automatically carved from HTTP/SMB/FTP traffic,
each clickable to view full-size and see the originating packet/session.)
Example 4: Discover cleartext credentials
Credentials tab
Output:
Frame Client IP Server IP Protocol Username Password
45 192.168.1.10 10.0.0.5 FTP admin Sup3rSecret!
201 192.168.1.10 10.0.0.9 HTTP Basic bob hunter2
Example 5: Review reconstructed sessions
Sessions tab
Output:
Client Server Protocol Port Duration Bytes
192.168.1.10:51322 93.184.216.34:443 TLS 443 14.2s 612 KB
192.168.1.10:55432 93.184.216.34:80 HTTP 80 3.1s 88 KB
Example 6: DNS tab, all resolved names
DNS tab
Output:
Timestamp Host DNS Query Resolved IP
10:22:41.821 192.168.1.10 example.com 93.184.216.34
10:22:52.114 192.168.1.10 malicious.biz 185.220.101.5
Example 7: Keyword search across all parsed content
Keywords tab -> enter "password" -> Search
Output:
Frame Context Source
201 ...Authorization: Basic Ym9iOmh1bnRlcjI=... HTTP header (decoded: bob:hunter2)
340 ...&password=changeme123&user=admin... HTTP POST parameter
Example 8: Parameters tab — extracted GET/POST parameters
Parameters tab
Output:
Frame Host Parameter Value
340 login.example.com password changeme123
340 login.example.com user admin
412 search.example.com q network+security+tools
Example 9: Reassembled email message (SMTP/POP3 capture)
Messages tab
Output:
From: alice@example.com
To: bob@example.com
Subject: Q3 Report
Date: 2026-07-15 09:12:33
Attached is the report you requested.
[Attachment: Q3_Report.xlsx detected and available in Files tab]
Example 10: Anomalies tab flagging malformed/suspicious packets
Anomalies tab
Output:
Frame Description
88 TCP checksum invalid
230 Unusually large DNS response (possible DNS tunneling / exfiltration)
Example 11: Loading multiple pcap files as a single “case”
File -> Open (select multiple .pcap files) or drag-and-drop several files
Output:
(All hosts, files, credentials, and sessions from every loaded file are
merged into unified tabs, allowing correlation across multiple captures
collected from different sensors or time periods.)
Example 12: Live sniffing on an interface
File -> Select Interface -> choose eth0 -> Start
Output:
[Live capture started on eth0]
Hosts tab updates in real time as new devices communicate on the network.
Common Use Cases
- Incident response: quickly determine what files, credentials, and hosts were involved in an attack captured on the wire.
- Malware traffic analysis: extract dropped payloads (executables, scripts) directly from a capture without manual reassembly.
- CTF (Capture The Flag) challenges: many network forensics CTF challenges are solved rapidly by loading the pcap into NetworkMiner and checking the Files/Credentials/Images tabs directly.
- Credential auditing: identifying legacy systems or misconfigured services still transmitting credentials in cleartext (FTP, HTTP Basic Auth, Telnet, POP3).
- Data loss / exfiltration investigations: spotting files or messages leaving the network via extracted artifacts.
- Passive asset discovery: building a host inventory (OS, hostname, open services) purely from observed traffic, without active scanning.
Automation with Bash
NetworkMiner is primarily a manual/GUI-driven forensic tool, so bash automation typically focuses on preparing input files and organizing output, rather than driving the GUI itself (the Professional Edition offers a CLI for batch processing, but the Community Edition on Kali is GUI-only). A typical bash-assisted workflow:
#!/bin/bash
# prep_for_networkminer.sh - merges and filters pcaps before NetworkMiner analysis
INDIR="/data/raw_captures"
OUTFILE="/data/merged_for_analysis.pcap"
# Merge multiple raw captures into a single file using mergecap (Wireshark suite)
mergecap -w "$OUTFILE" "${INDIR}"/*.pcap
# Optionally pre-filter with tshark to only the traffic window of interest
tshark -r "$OUTFILE" -Y "ip.addr==192.168.1.0/24" -w /data/filtered_for_nm.pcap
echo "[*] Prepared file ready for NetworkMiner: /data/filtered_for_nm.pcap"
echo "[*] Launch with: sudo mono /opt/NetworkMiner_2-8/NetworkMiner.exe /data/filtered_for_nm.pcap"
Automatically archiving NetworkMiner’s output folders (extracted files, cases) after an analysis session:
#!/bin/bash
# archive_nm_case.sh
CASE_DIR="$HOME/NetworkMiner/AssembledFiles"
ARCHIVE="/data/cases/case_$(date +%Y%m%d_%H%M%S).tar.gz"
tar -czf "$ARCHIVE" -C "$HOME/NetworkMiner" AssembledFiles
echo "[*] NetworkMiner extracted artifacts archived to $ARCHIVE"
Tips and Best Practices
- Always run NetworkMiner with sufficient privileges (
sudo) when performing live capture, since raw socket access requires elevated permissions; loading existing pcap files does not require root. - Use the “Keywords” tab early in an investigation — a keyword search across all reconstructed content (files, parameters, messages) is often the fastest way to find what you’re looking for.
- Cross-reference the Hosts tab OS fingerprinting with other sources; passive OS fingerprinting is a best-effort heuristic and can be wrong, especially behind NAT or with spoofed TTLs.
- Load related pcap files together into a single case to correlate hosts and sessions across multiple capture points (e.g., different network segments).
- Check the “Files” and “Images” tabs specifically after malware-related captures — dropped payloads and exfiltrated screenshots are frequently recoverable directly.
- Remember the Community Edition has some feature limitations (e.g., fewer supported protocols for parameter extraction, no GeoIP) compared to the paid Professional Edition; know which edition you are using.
- Since NetworkMiner performs deep, passive parsing, very large pcap files can take significant time and memory to load — pre-filter with
tshark/editcapfirst if the file is huge and only a subset is relevant.
Troubleshooting
Problem: NetworkMiner GUI fails to launch, Mono errors in terminal. Solution: Ensure mono-complete (not just the minimal mono-runtime) is installed, since GUI components require the complete package: sudo apt install mono-complete.
Problem: “Permission denied” when selecting a live interface. Solution: Launch with sudo since raw packet capture requires root/administrative privileges; reading an existing pcap file does not require this.
Problem: Extracted files are missing or incomplete. Solution: Confirm the original capture actually contains the full TCP stream (no missing packets/fragmented capture); NetworkMiner can only reconstruct what is present in the pcap — partial captures yield partial or corrupted files.
Problem: Application becomes very slow or unresponsive on large pcap files. Solution: Pre-filter the file with tshark/editcap to reduce it to the relevant time window or hosts before loading; increase available system RAM; close unused tabs.
Problem: GUI window renders incorrectly or fonts look broken. Solution: Ensure a proper X11/Wayland desktop session is active (NetworkMiner needs a graphical environment); install additional Mono Windows Forms dependencies (libgdiplus) if rendering issues occur: sudo apt install libgdiplus.
Problem: No hosts/files appear after loading a valid pcap. Solution: Verify the pcap actually contains the expected protocols (e.g., a pure ICMP-only capture will show no files/credentials); check that the file isn’t corrupted by validating it first with capinfos capture.pcap.
References
- Official NetworkMiner website (Netresec): https://www.netresec.com/?page=NetworkMiner
- NetworkMiner Manual/User Guide: https://www.netresec.com/?page=NetworkMiner
- Netresec Blog (usage tutorials and case studies): https://www.netresec.com/?page=Blog
- Kali Linux Tools listing for NetworkMiner: https://www.kali.org/tools/networkminer/
- Mono Project (runtime dependency): https://www.mono-project.com/
