NetworkMiner

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

NetworkMiner is ranked #7 of 33 in network packet analyzer software on Inferse. It runs on Linux, macOS, Windows. There is a free plan.

Compared on network packet analyzer software

Free plan: Yesnetresec.com

Facts

Purpose: NetworkMiner extracts artifacts such as files, images, emails and passwords from captured network traffic in PCAP files and can sniff live network traffic.netresec.com · 1 Oct 2026
Host inventory: The software aggregates detailed information about IP addresses into a network host inventory for passive asset discovery and communication overviews.netresec.com · 1 Oct 2026
Primary users: Netresec says NetworkMiner has been used by incident response teams, law enforcement, companies and organizations worldwide since its first release in 2007.netresec.com · 1 Oct 2026
Professional inputs: NetworkMiner Professional accepts PCAP, PcapNG and ETL capture files, Pcap-over-IP, PacketCache data and live sniffing.netresec.com · 1 Oct 2026
Professional exports: NetworkMiner Professional exports data in CSV for Excel, JSON-LD and XML formats.netresec.com · 1 Oct 2026
Protocol analysis: Professional supports file extraction from FTP, TFTP, HTTP, HTTP/2, SMB, SMB2, SMTP, POP3, IMAP and LPR protocols.netresec.com · 1 Oct 2026
VoIP: Professional supports SIP, RTP, G.711 and G.722, including audio extraction from unencrypted VoIP calls.netresec.com · 1 Oct 2026
OSINT: Professional provides OSINT lookups for file hashes, IP addresses, domain names and URLs, plus offline IP-to-country and IP ASN lookups.netresec.com · 1 Oct 2026
Command line: NetworkMinerCLI provides command-line scripting support and is available only with a Corporate License.netresec.com · 1 Oct 2026
TLS handling: NetworkMiner does not decrypt HTTPS or other TLS-encrypted sessions; it extracts X.509 certificates, and PolarProxy can decrypt traffic and forward it to NetworkMiner.netresec.com · 1 Oct 2026
Data location: NetworkMiner stores extracted data locally on the end-user device rather than in the cloud.netresec.com · 1 Oct 2026
Open source: The source code is written in 100% managed C# on the Microsoft .NET Framework and is released as GPLv2 free and open source software.netresec.com · 1 Oct 2026
Safety guidance: Netresec warns that opening PCAPs can automatically extract malware and recommends Linux or Windows Sandbox to reduce self-infection risk.netresec.com · 1 Oct 2026
FIPS compliance: NetworkMiner Professional is not FIPS 140-compliant and requires FIPS enforcement to be disabled on the PC.netresec.com · 1 Oct 2026