Navigation



NetworkMiner – Passive Sniffer & Packet Analysis Tool for Windows

Last updated: September 9, 2015 | 67,409 views

NetworkMiner is a passive network sniffer/packet capturing tool for Windows with an easy to use interface. It can detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off-line analysis.

NetworkMiner makes use of OS fingerprinting databases from both p0f (by Michal Zalewski) and Ettercap (by Alberto Ornaghi and Marco Valleri) in order to do as correct passive OS fingerprinting as possible. NetworkMiner also uses the MAC-vendor list from Nmap (Fyodor).

The purpose of NetworkMiner is to collect data about hosts on the network rather than to collect data regarding the traffic on the network. The main view is host centric (information grouped per host) rather than packet centric (information showed as a list of packets/frames).

NetworkMiner can extract files transferred over the network by parsing a PCAP file or by sniffing traffic directly from the network. This is a neat function that can be used to extract and save media files (such as audio or video files) which are streamed across a network.


Another very useful feature is that the user can search sniffed or stored data for keywords. NetworkMiner allows the user to insert arbitrary string or byte-patterns that shall be searched for with the keyword search functionality.

A feature the author wants to include in future versions of NetworkMiner is to use statistical methods to do protocol identification (protocol fingerprinting) of a TCP session or UDP data. This means that instead of looking at the port number to guess which protocol is used on top of the TCP/UDP packet NetworkMiner will identify the correct protocol based on the TCP/UDP packet content. In this way NetworkMiner will be able to identify protocols even if the service is run on a non-standard port.

You can download NetworkMiner here:

NetworkMiner-0.82

Or you can read more here.

Share2
Tweet5
Share1
Buffer
WhatsApp
Email
8 Shares
Posted in: Forensics, Hacking News, Networking Hacking Tools, Windows Hacking

, , , , , , ,


Latest Posts:


Aclpwn.Py - Exploit ACL Based Privilege Escalation Paths in Active Directory Aclpwn.Py – Exploit ACL Based Privilege Escalation Paths in Active Directory
Aclpwn.py is a tool that interacts with BloodHound< to identify and exploit ACL based privilege escalation paths.
July 7, 2021 - 65 Shares
Vulhub - Pre-Built Vulnerable Docker Environments For Learning To Hack Vulhub – Pre-Built Vulnerable Docker Environments For Learning To Hack
Vulhub is an open-source collection of pre-built vulnerable docker environments for learning to hack. No pre-existing knowledge of docker is required, just execute two simple commands.
May 27, 2021 - 209 Shares
LibInjection - Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) LibInjection – Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS)
LibInjection is a C library to Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) through lexical analysis of real-world Attacks.
May 7, 2021 - 90 Shares
Grype - Vulnerability Scanner For Container Images & Filesystems Grype – Vulnerability Scanner For Container Images & Filesystems
Grype is a vulnerability scanner for container images and filesystems with an easy to install binary that supports the packages for most major *nix based OS.
April 19, 2021 - 199 Shares
APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
March 5, 2021 - 225 Shares
GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc
February 3, 2021 - 153 Shares


9 Responses to NetworkMiner – Passive Sniffer & Packet Analysis Tool for Windows

  1. Pantagruel February 27, 2008 at 11:06 am #

    Nice one. The first thing I thought was, p0f with an clickerdiclick interface. Definitely one piece of software to watch developing

  2. Le00 February 27, 2008 at 4:29 pm #

    That’s nice. Also check http://w3af.sourceforge.net. It’s a really good audit framework, that can be useful for pentests.

  3. eM3rC February 28, 2008 at 12:37 am #

    Huge potential for this piece of software. Like Pantagruel will be watching this develop.

  4. Pantagruel March 2, 2008 at 9:40 am #

    Took it for a test drive, it works very well and is indeed less intimidating than p0f

  5. James C March 6, 2008 at 3:20 pm #

    Works like a charm! love it.

  6. Pantagruel March 8, 2008 at 7:56 pm #

    NetworkMiner-0.83 was released 1st of march

  7. fever April 8, 2008 at 6:55 pm #

    sounds like something so keep your eyes on.

  8. Erik May 21, 2008 at 6:47 pm #

    I released version 0.84 this weekend. So NetworkMiner now supports passive OS fingerprinting through sniffing of DHCP packets (the previous versions only used TCP packets). Network Miner also supports WiFi sniffing of IEEE 802.11 WLAN traffic.

    I’ve updated the NetworkMiner Wiki at:
    http://networkminer.wiki.sourceforge.net/NetworkMiner

  9. Pantagruel May 22, 2008 at 10:01 pm #

    @Erik

    Thanks for the heads up, will take the new version for a test drive an see if the OS detection has become more acurate.