Audience
Digital forensics investigators looking for a tool to reconstruct files, images, emails and other artifacts from captured network traffic
About NetworkMiner
NetworkMiner is a network forensics tool that extracts artifacts such as files, images, emails, and passwords from captured network traffic in PCAP files. It can also capture live network traffic by sniffing a network interface. Detailed information about each IP address in the analyzed network traffic is aggregated into a network host inventory, which can be used for passive asset discovery and to get an overview of communicating devices. NetworkMiner is primarily designed to run on Windows but can also be used on Linux. Since its first release in 2007, it has become a popular tool among incident response teams and law enforcement and is used by companies and organizations worldwide.
Other Popular Alternatives & Related Software
Paessler PRTG
Paessler PRTG is an all-inclusive monitoring software solution developed by Paessler. Equipped with an easy-to-use, intuitive interface with a cutting-edge monitoring engine, PRTG optimizes connections and workloads as well as reduces operational costs by avoiding outages while saving time and controlling service level agreements (SLAs). The solution is packed with specialized monitoring features that include flexible alerting, cluster failover solution, distributed monitoring, in-depth reporting, maps and dashboards, and more.
PRTG monitors your entire IT infrastructure. All important technologies are supported:
• SNMP: ready-to-use and custom options
• WMI and Windows Performance Counters
• SSH: for Linux/Unix and macOS systems
• Traffic analysis using flow protocols or packet sniffing
• HTTP requests
• REST APIs returning XML or JSON
• Ping, SQL, and many more
Learn more
Riverbed Packet Analyzer
Riverbed Packet Analyzer accelerates real-time network packet analysis and reporting of large trace files through an intuitive graphical user interface and a broad selection of pre-defined analysis views. It enables users to quickly identify and troubleshoot complex network and application performance issues down to the bit level, with full integration with Wireshark. By simply dragging and dropping preconfigured analysis views onto a group of virtual interfaces or a packet trace file, users can see results immediately, transforming hours of work into seconds. The tool facilitates the capture and merging of multiple trace files, allowing for precise pinpointing of problems across multiple segments. Additionally, it provides the capability to zoom into a 100-microsecond view of the network to identify utilization spikes or microbursts that can saturate a gigabit network and cause significant issues.
Learn more
Xplico
Xplico is installed in the major distributions of digital forensics and penetration testing: Kali Linix, BackTrack, DEFT, Security Onion, Matriux, BackBox, CERT Forensics Tools, Pentoo and CERT-Toolkit. Xplico allows concurrent access by multiple users. Any user can manage one or more Cases. The UI is a Web User Interface and its backend DB can be SQLite, MySQL or PostgreSQL. Xplico can be used as a Cloud Network Forensic Analysis Tool. The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on. Xplico isn’t a network protocol analyzer. Xplico is an open source Network Forensic Analysis Tool (NFAT). At each data reassembled by Xplico is associated a XML file that uniquely identifies the flows and the pcap containing the data reassembled.
Learn more
VisualEther
VisualEther turns Wireshark packet captures (PCAP/PCAPNG) into readable sequence diagrams — and lets AI coding agents like Claude Code explain, in plain English, why a network session failed.
Wireshark shows every packet but not the conversation. VisualEther draws it directly from the capture — frame-accurate and reproducible — using 82+ built-in protocol templates spanning 5G NR, 5G core, LTE, IMS/VoLTE, SIP/RTP, BGP, OSPF, DNS, HTTP/2, HTTP/3, TLS, Kerberos, Diameter, GTP, and industrial protocols (Modbus, DNP3, EtherNet/IP).
A built-in MCP server extracts only the messages and fields that matter, so an AI agent reads kilobytes of structured data instead of megabytes of raw packets — then runs an author-debug-verify loop, citing frame numbers as evidence. Built on tshark: anything Wireshark can dissect, VisualEther can diagram.
See, Triage, Diagnose, Automate. Windows (winget), macOS (Homebrew), Linux (apt/dnf). Free Community edition; paid Professional and Server editions
Learn more
Pricing
Starting Price:
$1,300 one-time payment
Free Version:
Free Version available.
Integrations
No integrations listed.
Company Information
Netresec
Founded: 2010
Sweden
www.netresec.com/
Videos and Screen Captures
Other Useful Business Software
Cut Data Warehouse Costs by 54%
BigQuery delivers 54% lower TCO with exabyte scale and flexible pricing. Free migration tools handle the SQL translation automatically.
Product Details
Platforms Supported
Windows
Linux
Training
Documentation
Live Online
In Person
Videos
Support
Phone Support
Online