NetworkMiner
NetworkMiner is a Windows-based GUI network forensics tool that organizes evidence by host rather than by packet or flow. It automatically extracts files, credentials, and certificates from PCAP and presents them in a host-centric view: click a host to see what it sent, received, what files it transferred, and what credentials were exposed. It's the fastest tool for answering "what did this specific host do?"
You have a 1.2 GB PCAP from a compromised host's network segment. You need to answer: What files did the compromised host transfer to external IPs? Were any credentials transmitted in cleartext? What OS is the attacker's C2 server running (based on TTL and TCP fingerprint)? NetworkMiner answers all three in under 5 minutes by organizing the evidence by host rather than forcing you to search through millions of packets.
Host-Centric View
NetworkMiner Interface Layout ═══════════════════════════════════════════════════════════════════ ┌─────────────────────────────────────────────────────────────────┐ │ File Tools Help │ │ Case Panel: [CASE-2026-009] [Open PCAP] │ ├───────────────┬─────────────────────────────────────────────────┤ │ Hosts │ Tabs: Files | Messages | Credentials | Sessions │ │ ────────── │ DNS | Parameters | Keywords │ │ │ │ │ ► 10.0.1.50 │ Files tab (when 10.0.1.50 is selected): │ │ Port 49812 │ Filename | Size | Source host | MD5 │ │ TTL: 128 │ svhost.exe | 47KB | 185.220.101.47|abc123 │ │ OS: Windows │ svc32.dll |890KB | 185.220.101.47|def456 │ │ │ stage.ps1 | 1.2KB| 185.220.101.47|ghi789 │ │ ► 185.220.101 │ │ │ TTL: 53 │ Credentials tab (when any host is selected): │ │ OS: Linux │ Username | Password | Protocol | Source Host │ │ │ jsmith | Pass123! | HTTP Basic| proxy.corp.com│ │ ► 192.168.1.1 │ ftpuser | letmein | FTP | ftp.corp.com │ └───────────────┴─────────────────────────────────────────────────┘ OS Detection (passive fingerprinting): ├── TTL = 128 → Windows (Windows default TTL) ├── TTL = 64 → Linux/macOS ├── TTL = 255 → Cisco/network device ├── TCP window size + options → more precise OS identification └── These are "as seen on the network" — an attacker can spoof TTL
Files Tab — Automatic File Extraction
NetworkMiner Files Tab Details ═══════════════════════════════════════════════════════════════════ Shows all files transferred in the capture, with: ├── Filename: detected filename (from HTTP Content-Disposition or URL path) ├── Size: file size in bytes ├── Type: detected MIME type (from Content-Type or magic bytes) ├── Source Host: which IP served the file ├── Destination Host: which IP received it ├── Timestamp: when the transfer occurred ├── MD5/SHA1: hash of extracted file (hover over row) └── Storage location: NetworkMiner saves extracted files to disk automatically Extraction path: C:\Users\analyst\NetworkMiner\AssembledFiles\ Each file is saved as its detected filename or a generated name. File type icons: ├── Blue page = script (HTML, JS, PowerShell, VBScript) ├── Gear = executable (PE, ELF, macOS binary) ├── Archive box = ZIP, RAR, GZIP, etc. ├── Image = images (sometimes used for steganography) └── Document = Office files (potential macro payloads) Right-click menu on a file: ├── Open containing folder ├── Calculate MD5/SHA1/SHA256 ├── Open in hex editor (if HxD is installed) └── Search hash on VirusTotal (opens browser)
Credentials Tab — Cleartext Authentication
| Protocol | What NetworkMiner extracts | Forensic significance |
|---|---|---|
| HTTP Basic Auth | Base64-decoded username:password from Authorization header | Immediate credential compromise; confirm if password still valid |
| FTP | USER and PASS commands in cleartext FTP session | FTP credentials — often reused; indicates legacy cleartext file transfer |
| Telnet | Keystroke reconstruction including typed password | Legacy device access — very rare but still found in OT environments |
| POP3 | USER/PASS commands (unencrypted POP3) | Email account credentials — may enable business email compromise |
| IMAP | LOGIN command (unencrypted IMAP) | Same as POP3 |
| SMTP AUTH | Base64-decoded credentials in AUTH PLAIN/LOGIN | Email sending account — used for phishing relay |
| HTTP form POST | username/password field values from HTML forms | Web application credentials submitted over HTTP |
No other common pcap analysis tool automatically extracts cleartext credentials and presents them in a single tab. In tshark and Wireshark you can find credentials by following specific streams or using display filters — but you need to know where to look. NetworkMiner scans the entire capture for credential patterns across all protocols simultaneously. In a corporate environment with legacy HTTP, FTP, or unencrypted email still operating, the Credentials tab can immediately surface plaintext passwords that were in transit during the investigation window — either the attacker's credential theft activity or legitimate traffic where credentials are exposed. Document every credential found and treat each one as potentially compromised until verified otherwise.
NetworkMiner vs Wireshark vs tshark
| Capability | NetworkMiner | Wireshark | tshark |
|---|---|---|---|
| Host-centric view | Native — hosts tab is primary interface | Endpoints/Conversations (statistics only) | Via field extraction + awk |
| Automatic file extraction | Yes — all protocols, saved to disk | Yes — File → Export Objects (limited protocols) | Yes — --export-objects flag |
| Credential extraction | Yes — Credentials tab, all major protocols | No — manual stream following required | Via field extraction for known protocols |
| OS fingerprinting | Yes — passive TTL + TCP option analysis | No native support (needs plugin) | No |
| Large file handling | Slow on >500 MB files (Windows GUI) | Slow on >500 MB (GUI) | Fast — optimized CLI, parallelizable |
| Scripting/automation | Limited (command-line version exists) | No | Full scripting via bash/Python |
| Best use case | Quick host investigation, credential hunting | Deep interactive analysis | Bulk processing, automation, headless |
Q & A
Q: NetworkMiner shows OS detection as "Linux" for the C2 server. How reliable is this?
Passive OS fingerprinting from TTL and TCP options is useful context but not reliable enough to make definitive conclusions. It estimates the OS at the network level, but: (1) Attackers can trivially change TTL with simple firewall rules or OS settings — a Windows server can be configured to send TTL=64 to impersonate Linux. (2) The TTL you see in the capture is the TTL AFTER transit — for a host 5 hops away, a starting TTL of 64 would arrive at 59, and NetworkMiner would correctly identify this as Linux. But if the hop count is wrong or inconsistent (due to asymmetric routing), the calculated initial TTL will be wrong. (3) TTL alone has a high false-positive rate — multiple OS types use the same default TTL (64 is both Linux and many network appliances). Use OS fingerprinting as a hint to guide hypothesis formation, not as conclusive evidence. If you need to confirm the C2 server's OS, look for OS-specific TLS options in the ServerHello, the HTTP server header in its responses, or other behavioral signals.