Offensive Security Researcher & Quantum Cryptography Analyst

NetworkMiner: Complete Guide to Network Forensics and Packet Analysis Using Kali Linux

Abdul Wahab Junaid
NetworkMiner: Complete Guide to Network Forensics and Packet Analysis Using Kali Linux

NetworkMiner is a Network Forensic Analysis Tool (NFAT) created by Netresec. Unlike Wireshark, Tshark, or tcpdump, which present traffic as a chronological list of individual packets, NetworkMiner takes a host-centric and artifact-centric approach: it passively parses a capture file (or sniffs live traffic) and automatically reconstructs the meaningful objects hidden inside the traffic — files transferred over HTTP/FTP/SMB, images, credentials sent in cleartext, DNS names, session cookies, certificates, and detailed host profiles (operating system, open ports, hostnames) — without requiring the analyst to actively hunt through packets one by one.

NetworkMiner was originally written for Windows (.NET Framework) but runs on Linux, including Kali Linux, via Mono. It has both a free/open-source Community Edition and a paid Professional Edition with additional features (such as geolocation, port-independent protocol identification for more protocols, and case management). The Community Edition, which is what ships with Kali, is more than sufficient for most forensic and CTF-style analysis tasks.

NetworkMiner is widely used in incident response to quickly answer questions like “what files were downloaded during this attack?”, “were any credentials sent in the clear?”, and “what hosts were talking to each other and what operating systems were they running?” — all directly from a pcap file, without manual packet-by-packet inspection.

How to Install

NetworkMiner is available in the Kali Linux repositories and depends on Mono to run its .NET-based GUI:

# Update package lists
sudo apt update

# Install Mono runtime (required dependency) and NetworkMiner
sudo apt install mono-complete -y
sudo apt install networkminer -y

If NetworkMiner is not available directly via apt on your Kali version, install manually from Netresec:

cd /opt
sudo wget https://www.netresec.com/?download=NetworkMiner -O NetworkMiner.zip
sudo unzip NetworkMiner.zip
cd NetworkMiner_*/
sudo chmod +x NetworkMiner.exe
# Fix executable and script permissions per the included README
sudo chmod +x NetworkMiner.sh 2>/dev/null

Verify Mono is correctly installed:

mono --version

Expected output:

Mono JIT compiler version 6.12.0.200 (tarball Wed Jan 1 00:00:00 UTC 2024)
Copyright (C) 2002-2014 Novell, Inc, Xamarin Inc and Contributors.

Launch NetworkMiner (requires a graphical session):

sudo mono /opt/NetworkMiner_2-8/NetworkMiner.exe

Or, if installed via apt with a wrapper script:

sudo networkminer

Syntax

NetworkMiner is primarily a GUI tool; it does not have an extensive scriptable CLI like tcpdump or tshark. It is launched, and files or interfaces are chosen from within the GUI:

mono NetworkMiner.exe [pcap file]

Examples:

sudo mono NetworkMiner.exe                       # Launch GUI empty
sudo mono NetworkMiner.exe capture.pcap           # Launch and load a pcap directly

Live sniffing requires selecting an interface inside the GUI (File -> Select Interface -> Start).

All Command-Line Options (Kali Linux)

NetworkMiner’s command-line surface is minimal since it is GUI-driven; the executable primarily accepts a single optional argument (an input capture file) at launch. There is no dedicated flag-based CLI equivalent to tcpdump/tshark. The GUI itself exposes its full functionality through menus and tabs rather than switches:

Usage:
  NetworkMiner.exe [pcap-file]

Arguments:
  pcap-file      Optional. Path to a .pcap/.pcapng/.cap file to load
                 automatically when the GUI starts.

GUI Menu Equivalents (accessed after launch):
  File -> Open                        Load a capture file
  File -> Select Interface            Choose a live NIC for passive sniffing
  File -> Receive PCAP over IP        Ingest a stream sent from a remote sensor
  Tools -> Options                    Configure output/temp directories, ports
  Case Panel                          Manage multiple loaded capture files as one "case"

Key functional tabs inside the GUI (not CLI flags, but the core “commands” of the tool):

Hosts             - List of all detected hosts with OS fingerprint, MAC, hostname
Files             - All files reconstructed/carved from traffic
Images            - All image files extracted, shown as thumbnails
Messages           - Extracted emails, chat messages
Credentials        - Extracted usernames/passwords sent in cleartext protocols
Sessions            - Reconstructed TCP/UDP sessions
DNS                 - All resolved DNS queries/responses
Parameters          - Extracted HTTP/URL parameters
Keywords            - Custom keyword search across all reconstructed content
Anomalies           - Detected anomalies (e.g., malformed packets)

Basic Usage (Expected Output in Bash)

Launching NetworkMiner from the terminal:

sudo mono /opt/NetworkMiner_2-8/NetworkMiner.exe

Expected terminal output:

[MainForm] Loading NetworkMiner GUI...
[MainForm] Initializing packet parsers...
(GUI window opens; no further structured stdout is produced during normal use,
 since NetworkMiner is a graphical application)

Loading a capture file directly from the command line:

sudo mono /opt/NetworkMiner_2-8/NetworkMiner.exe /home/kali/captures/incident.pcap

Expected behavior:

(GUI opens with incident.pcap already parsed; the Hosts, Files, Images,
 Credentials, and Sessions tabs are automatically populated based on the
 contents of the file.)

Practical Examples with Output

Example 1: Load a pcap and review discovered hosts

sudo mono NetworkMiner.exe capture.pcap

Hosts tab (representative table):

Host                IP Address       MAC Address         OS               Hostname
Host 1              192.168.1.10     aa:bb:cc:11:22:33   Windows 10       DESKTOP-ABC123
Host 2              93.184.216.34    (remote)            Linux 3.x/4.x    example.com
Host 3              192.168.1.1      aa:bb:cc:99:88:77   Linux (router)   gateway.local

Example 2: Extract files transferred over HTTP

Files tab (auto-populated after loading capture.pcap)

Output:

Frame  Filename          Size     Source Host      Destination Host   Protocol
102    invoice.pdf       245 KB   93.184.216.34    192.168.1.10        HTTP
188    update.exe        1.2 MB   151.101.1.69     192.168.1.10        HTTP

Example 3: View extracted images

Images tab

Output:

(Grid of thumbnail images automatically carved from HTTP/SMB/FTP traffic,
 each clickable to view full-size and see the originating packet/session.)

Example 4: Discover cleartext credentials

Credentials tab

Output:

Frame  Client IP        Server IP        Protocol   Username    Password
45     192.168.1.10     10.0.0.5         FTP        admin       Sup3rSecret!
201    192.168.1.10     10.0.0.9         HTTP Basic bob          hunter2

Example 5: Review reconstructed sessions

Sessions tab

Output:

Client                Server              Protocol   Port   Duration   Bytes
192.168.1.10:51322    93.184.216.34:443   TLS        443    14.2s      612 KB
192.168.1.10:55432    93.184.216.34:80    HTTP       80     3.1s       88 KB

Example 6: DNS tab, all resolved names

DNS tab

Output:

Timestamp             Host          DNS Query        Resolved IP
10:22:41.821          192.168.1.10  example.com      93.184.216.34
10:22:52.114          192.168.1.10  malicious.biz     185.220.101.5

Example 7: Keyword search across all parsed content

Keywords tab -> enter "password" -> Search

Output:

Frame   Context                                              Source
201     ...Authorization: Basic Ym9iOmh1bnRlcjI=...          HTTP header (decoded: bob:hunter2)
340     ...&password=changeme123&user=admin...                HTTP POST parameter

Example 8: Parameters tab — extracted GET/POST parameters

Parameters tab

Output:

Frame   Host              Parameter        Value
340     login.example.com password         changeme123
340     login.example.com user             admin
412     search.example.com q                network+security+tools

Example 9: Reassembled email message (SMTP/POP3 capture)

Messages tab

Output:

From: alice@example.com
To: bob@example.com
Subject: Q3 Report
Date: 2026-07-15 09:12:33

Attached is the report you requested.
[Attachment: Q3_Report.xlsx  detected and available in Files tab]

Example 10: Anomalies tab flagging malformed/suspicious packets

Anomalies tab

Output:

Frame   Description
88      TCP checksum invalid
230     Unusually large DNS response (possible DNS tunneling / exfiltration)

Example 11: Loading multiple pcap files as a single “case”

File -> Open (select multiple .pcap files) or drag-and-drop several files

Output:

(All hosts, files, credentials, and sessions from every loaded file are
 merged into unified tabs, allowing correlation across multiple captures
 collected from different sensors or time periods.)

Example 12: Live sniffing on an interface

File -> Select Interface -> choose eth0 -> Start

Output:

[Live capture started on eth0]
Hosts tab updates in real time as new devices communicate on the network.

Common Use Cases

Automation with Bash

NetworkMiner is primarily a manual/GUI-driven forensic tool, so bash automation typically focuses on preparing input files and organizing output, rather than driving the GUI itself (the Professional Edition offers a CLI for batch processing, but the Community Edition on Kali is GUI-only). A typical bash-assisted workflow:

#!/bin/bash
# prep_for_networkminer.sh - merges and filters pcaps before NetworkMiner analysis

INDIR="/data/raw_captures"
OUTFILE="/data/merged_for_analysis.pcap"

# Merge multiple raw captures into a single file using mergecap (Wireshark suite)
mergecap -w "$OUTFILE" "${INDIR}"/*.pcap

# Optionally pre-filter with tshark to only the traffic window of interest
tshark -r "$OUTFILE" -Y "ip.addr==192.168.1.0/24" -w /data/filtered_for_nm.pcap

echo "[*] Prepared file ready for NetworkMiner: /data/filtered_for_nm.pcap"
echo "[*] Launch with: sudo mono /opt/NetworkMiner_2-8/NetworkMiner.exe /data/filtered_for_nm.pcap"

Automatically archiving NetworkMiner’s output folders (extracted files, cases) after an analysis session:

#!/bin/bash
# archive_nm_case.sh
CASE_DIR="$HOME/NetworkMiner/AssembledFiles"
ARCHIVE="/data/cases/case_$(date +%Y%m%d_%H%M%S).tar.gz"

tar -czf "$ARCHIVE" -C "$HOME/NetworkMiner" AssembledFiles
echo "[*] NetworkMiner extracted artifacts archived to $ARCHIVE"

Tips and Best Practices

Troubleshooting

Problem: NetworkMiner GUI fails to launch, Mono errors in terminal. Solution: Ensure mono-complete (not just the minimal mono-runtime) is installed, since GUI components require the complete package: sudo apt install mono-complete.

Problem: “Permission denied” when selecting a live interface. Solution: Launch with sudo since raw packet capture requires root/administrative privileges; reading an existing pcap file does not require this.

Problem: Extracted files are missing or incomplete. Solution: Confirm the original capture actually contains the full TCP stream (no missing packets/fragmented capture); NetworkMiner can only reconstruct what is present in the pcap — partial captures yield partial or corrupted files.

Problem: Application becomes very slow or unresponsive on large pcap files. Solution: Pre-filter the file with tshark/editcap to reduce it to the relevant time window or hosts before loading; increase available system RAM; close unused tabs.

Problem: GUI window renders incorrectly or fonts look broken. Solution: Ensure a proper X11/Wayland desktop session is active (NetworkMiner needs a graphical environment); install additional Mono Windows Forms dependencies (libgdiplus) if rendering issues occur: sudo apt install libgdiplus.

Problem: No hosts/files appear after loading a valid pcap. Solution: Verify the pcap actually contains the expected protocols (e.g., a pure ICMP-only capture will show no files/credentials); check that the file isn’t corrupted by validating it first with capinfos capture.pcap.

References

Exit mobile version