NetworkMiner

NetworkMiner (developed by Netresec) is an open-source and commercial Network Forensic Analysis Tool (NFAT) and passive packet sniffer engineered for digital forensics, incident response, and cyber threat hunting teams. While traditional packet capture tools like Wireshark organize network captures around individual packets and protocol frames, NetworkMiner takes an intuitive host-centric approach: it parses PCAP capture files to extract and display network hosts, open sessions, hostnames, operating system fingerprints, and open ports automatically. The platform excels at automated artifact extraction, reconstructing transferred files, images, emails, certificates, and credentials directly from unencrypted network traffic streams without executing the underlying files. Because NetworkMiner operates as a completely passive sniffer that does not transmit a single packet onto the physical network wire, forensic analysts can conduct stealth investigations without alerting adversaries or disrupting sensitive network infrastructure. The commercial version, NetworkMiner Professional, incorporates advanced capabilities including port-independent protocol identification, PCAP-over-IP streaming, and automated decapsulation of GRE, VXLAN, and MPLS traffic. NetworkMiner provides digital forensic analysts with a powerful, fast, and accessible tool for unmasking adversary activity and extracting forensic evidence.