Overview

NetworkMiner extracts files, images, emails and passwords from PCAP captures, and can sniff live network traffic. It also organizes IP-address details into a host inventory for passive asset discovery and communication overviews, making it useful when an investigation needs both recovered artifacts and context about the hosts involved.

It runs on Linux, macOS and Windows as desktop software, and keeps extracted data on the end-user device rather than in the cloud. Its source is GPLv2 free and open source, written in managed C# on the Microsoft .NET Framework. Netresec says incident response teams, law enforcement, companies and organizations have used it since its first release in 2007.

PCAP files can automatically yield malware when opened. Netresec recommends Linux or Windows Sandbox to reduce self-infection risk, so untrusted captures should be handled in an isolated environment. NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions; it can extract X.509 certificates, while PolarProxy can decrypt traffic and forward it to NetworkMiner as a separate step.

Key features

Capture inputs and exports

The Free Edition parses PCAP and ETL files and supports live sniffing, but cannot parse PcapNG. Professional expands input to PcapNG, Pcap-over-IP, PacketCache data and live sniffing, as well as PCAP and ETL. That broader intake is valuable for teams receiving captures in different formats or from remote sources; the free edition is less suitable when PcapNG is part of the routine workflow.

Professional can export results as CSV for Excel, JSON-LD and XML. Those options make it easier to move findings into spreadsheets or other workflows, while the free plan does not include these published Professional export formats.

Protocol, VoIP and OSINT analysis

Professional extracts files from FTP, TFTP, HTTP, HTTP/2, SMB, SMB2, SMTP, POP3, IMAP and LPR traffic. It also supports SIP and RTP, including audio extraction from unencrypted G.711 and G.722 VoIP calls. These additions make the paid edition more useful for investigations spanning varied application protocols or unencrypted calls, but they do not overcome encryption: TLS sessions remain undecrypted.

Professional adds OSINT lookups for file hashes, IP addresses, domain names and URLs, plus offline IP-to-country and IP ASN lookups. NetworkMinerCLI provides command-line scripting, but only with a Corporate License. Professional is not FIPS 140-compliant and requires FIPS enforcement to be disabled on the PC, an important constraint for organizations that must maintain that setting.

Pricing

NetworkMiner uses a freemium model, with a free edition and two paid licenses. The free edition is free and includes live sniffing and PCAP/ETL parsing on Windows and Linux, but not PcapNG parsing. It is a sensible starting point for individual investigations that fit those inputs; it does not provide the paid edition's stated expanded formats, exports, protocol analysis, VoIP or OSINT capabilities.

The Single User License costs 1300.00 USD per once. It covers one named employee and the GUI application, with free updates and support for three years; the license is valid for three years from purchase. This is the paid option for one investigator who needs Professional capabilities without command-line scripting. The Corporate License costs 6500.00 USD per once and is perpetual for unlimited employees in the registered organization. It includes GUI and command-line applications, with free updates and support during the first year, making it the relevant choice when multiple staff need access or scripting is required.

Platforms

NetworkMiner runs on Linux, macOS and Windows. It is desktop software, with both capture-file analysis and live traffic capture; the Free Edition's stated platform coverage is Windows and Linux.

Who it's for

NetworkMiner suits incident responders, law enforcement investigators and organizational security teams looking to recover artifacts and map host communications from captures or live traffic. The free edition fits work based on PCAP or ETL and live sniffing; Professional is better for mixed capture formats, broader protocol extraction, VoIP audio or OSINT lookups. It is a poor fit when native TLS decryption is essential, when PcapNG parsing must be free, or when FIPS 140 compliance is required.

Pros and cons

Pros: Extracts several useful artifact types and organizes IP details into a host inventory, combining evidence recovery with passive asset and communication context.
Pros: Professional accepts more capture formats and adds protocol extraction, VoIP audio, exports and OSINT lookups for investigators with broader needs.
Pros: Extracted data stays on the end-user device, and the source is GPLv2 free and open source.
Cons: Neither edition decrypts TLS sessions, so encrypted web and other TLS traffic cannot be recovered as decrypted content through NetworkMiner alone.
Cons: The free edition cannot parse PcapNG, and the paid licenses are substantial one-time costs for a single-user or organizational deployment.
Cons: Opening captures may automatically extract malware, requiring care and an isolated environment for untrusted files; Professional also requires FIPS enforcement to be disabled.

Alternatives

For a Windows-focused alternative with a free tier and paid Professional plan, Colasoft Capsa offers a free edition limited to monitoring 10 IP addresses and sessions with a four-hour timeout; its free tier also excludes WiFi connection monitoring.

Termshark is a free option across Android, Linux, macOS and Windows, but requires tshark in PATH and does not expose every tshark feature. For self-hosted, free software, Malcolm runs across a broad set of platforms and is Apache License 2.0 software. Arkime is another free, open-source self-hosted option with no paid-only features or license fees.

PCAPdroid is an Android choice with free core monitoring and capture; firewall, malware detection and PCAPng are among its paid features. For fully free options on Linux, macOS and Windows, Sniffnet is open source under MIT or Apache-2.0, while Wireshark offers its full version without a license fee. tcpdump is free BSD-licensed software, with capture permission dependent on the operating system and configuration.

Readers comparing tools by role can also browse Network Packet Capture Software, Network Protocol Analyzers, Network Packet Analyzer Software and Digital Forensics Software.

Verdict

Choose NetworkMiner if you need artifact extraction and host context from saved captures or live traffic, and the free edition's input limits are acceptable or Professional's broader analysis justifies its cost. Look elsewhere if you need TLS decryption within the tool, free PcapNG parsing, or FIPS 140 compliance.

	My Network Consultant	NetworkMiner
Free plan		Yes
Paid from		Free
Platforms	Web	Linux, macOS, Windows
Free plan	Yes	Yes
Deployment	server	desktop
Capture sources	local	both
PCAP support	Yes	Yes
Flow analysis	Yes	Yes
Traffic decryption		No
CLI tools		Yes
Remote capture		Yes

My Network Consultant vs NetworkMiner

My Network Consultant

NetworkMiner