NetworkMiner

NetworkMiner is an open-source traffic sniffer, PCAP handler and protocol analyser.
Developed and maintained by Netresec.

Tool Description

NetworkMiner is an open-source Network Forensic Analysis Tool (NFAT). It runs on Windows, Linux, macOS, and FreeBSD, and can be used two ways: as a passive sniffer that fingerprints hosts, sessions, and open ports without sending any traffic, or as a PCAP parser that reassembles files and certificates from captured traffic for offline analysis. This room covers the basics of network analysis and walks you through investigating captured traffic with NetworkMiner.

Learning Objectives

• Discover what NetworkMiner is
• Learn the basics of NetworkMiner
• Explore the different information tabs and extract information efficiently

Prerequisites

• Complete the Network Fundamentals room

Environment and Setup

Throughout this room we will use the same VM for the walkthrough and the exercises. This is an Ubuntu 20.04 VM where two versions of NetworkMiner are installed. Instructions are included in the tasks when to use a certain version. Start the VM by clicking the Start Virtual Machine button. The VM will start in split-view, if this is not the case, click the blue Show Split View at the top of the room.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Target Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Target machine

Status:Off

Start Machine

How To Start NetworkMiner

Navigate to the Desktop of the VM and open the NetworkMiner folder (choose the correct version), then double-click the NetworkMiner.exe binary to start NetworkMiner. The image below shows the visual flow. Note: When loading larger PCAP files, it can take up to a minute to complete (please be patient). Sometimes, due to the way NetworkMiner visualises the data, some packets/frames are not shown. If you notice that you are missing a frame (when answering a question for example), please reload the PCAP.