Audience
Digital forensics investigators looking for a tool to reconstruct files, images, emails and other artifacts from captured network traffic
About NetworkMiner
NetworkMiner is a network forensics tool that extracts artifacts such as files, images, emails, and passwords from captured network traffic in PCAP files. It can also capture live network traffic by sniffing a network interface. Detailed information about each IP address in the analyzed network traffic is aggregated into a network host inventory, which can be used for passive asset discovery and to get an overview of communicating devices. NetworkMiner is primarily designed to run on Windows but can also be used on Linux. Since its first release in 2007, it has become a popular tool among incident response teams and law enforcement and is used by companies and organizations worldwide.
Other Popular Alternatives & Related Software
Paessler PRTG
Paessler PRTG is an all-inclusive monitoring software solution developed by Paessler. Equipped with an easy-to-use, intuitive interface with a cutting-edge monitoring engine, PRTG optimizes connections and workloads as well as reduces operational costs by avoiding outages while saving time and controlling service level agreements (SLAs). The solution is packed with specialized monitoring features that include flexible alerting, cluster failover solution, distributed monitoring, in-depth reporting, maps and dashboards, and more.
PRTG monitors your entire IT infrastructure. All important technologies are supported:
• SNMP: ready-to-use and custom options
• WMI and Windows Performance Counters
• SSH: for Linux/Unix and macOS systems
• Traffic analysis using flow protocols or packet sniffing
• HTTP requests
• REST APIs returning XML or JSON
• Ping, SQL, and many more
Learn more
Riverbed Packet Analyzer
Riverbed Packet Analyzer accelerates real-time network packet analysis and reporting of large trace files through an intuitive graphical user interface and a broad selection of pre-defined analysis views. It enables users to quickly identify and troubleshoot complex network and application performance issues down to the bit level, with full integration with Wireshark. By simply dragging and dropping preconfigured analysis views onto a group of virtual interfaces or a packet trace file, users can see results immediately, transforming hours of work into seconds. The tool facilitates the capture and merging of multiple trace files, allowing for precise pinpointing of problems across multiple segments. Additionally, it provides the capability to zoom into a 100-microsecond view of the network to identify utilization spikes or microbursts that can saturate a gigabit network and cause significant issues.
Learn more
Xplico
Xplico is installed in the major distributions of digital forensics and penetration testing: Kali Linix, BackTrack, DEFT, Security Onion, Matriux, BackBox, CERT Forensics Tools, Pentoo and CERT-Toolkit. Xplico allows concurrent access by multiple users. Any user can manage one or more Cases. The UI is a Web User Interface and its backend DB can be SQLite, MySQL or PostgreSQL. Xplico can be used as a Cloud Network Forensic Analysis Tool. The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on. Xplico isn’t a network protocol analyzer. Xplico is an open source Network Forensic Analysis Tool (NFAT). At each data reassembled by Xplico is associated a XML file that uniquely identifies the flows and the pcap containing the data reassembled.
Learn more
WinDump
WinDump is the Windows version of tcpdump, the command line network analyzer for UNIX. WinDump is fully compatible with tcpdump and can be used to watch, diagnose and save to disk network traffic according to various complex rules. It can run under Windows 95, 98, ME, NT, 2000, XP, 2003 and Vista. WinDump captures using the WinPcap library and drivers, which are freely downloadable from the WinPcap website. WinDump supports 802.11b/g wireless capture and troubleshooting through the Riverbed AirPcap adapter. WinDump is free and is released under a BSD-style license. WinDump is able to use the interfaces exported by WinPcap. WinDump can run on all the operating systems supported by WinPcap. WinDump is the porting of tcpdump. It is possible to launch more than one session (on the same network adapter or on different adapters). Except for the increased CPU load, there are no drawbacks in using multiple applications at the same time.
Learn more
Pricing
Starting Price:
$1,300 one-time payment
Free Version:
Free Version available.
Integrations
No integrations listed.
Company Information
Netresec
Founded: 2010
Sweden
www.netresec.com/
Videos and Screen Captures
Other Useful Business Software
Field Service+ for MS Dynamics 365 & Salesforce
Resco’s mobile solution streamlines your field service operations with offline work, fast data sync, and powerful tools for frontline workers, all natively integrated into Dynamics 365 and Salesforce.
Product Details
Platforms Supported
Windows
Linux
Training
Documentation
Live Online
In Person
Videos
Support
Phone Support
Online
