{"id":755,"date":"2008-02-27T10:38:05","date_gmt":"2008-02-27T10:38:05","guid":{"rendered":"https:\/\/www.darknet.org.uk\/2008\/02\/networkminer-passive-sniffer-packet-analysis-tool-for-windows\/"},"modified":"2015-09-09T19:39:36","modified_gmt":"2015-09-09T11:39:36","slug":"networkminer-passive-sniffer-packet-analysis-tool-for-windows","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2008\/02\/networkminer-passive-sniffer-packet-analysis-tool-for-windows\/","title":{"rendered":"NetworkMiner &#8211; Passive Sniffer &#038; Packet Analysis Tool for Windows"},"content":{"rendered":"<p>NetworkMiner is a passive network sniffer\/packet capturing tool for Windows with an easy to use interface. It can detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off-line analysis.<\/p>\n<p>NetworkMiner makes use of OS fingerprinting databases from both p0f (by Michal Zalewski) and Ettercap (by Alberto Ornaghi and Marco Valleri) in order to do as correct passive OS fingerprinting as possible. NetworkMiner also uses the MAC-vendor list from Nmap (Fyodor).<\/p>\n<p>The purpose of NetworkMiner is to collect data about hosts on the network rather than to collect data regarding the traffic on the network. The main view is host centric (information grouped per host) rather than packet centric (information showed as a list of packets\/frames).<\/p>\n<p>NetworkMiner can extract files transferred over the network by parsing a PCAP file or by sniffing traffic directly from the network. This is a neat function that can be used to extract and <a href=\"http:\/\/networkminer.wiki.sourceforge.net\/save+media+files\">save media files<\/a> (such as audio or video files) which are streamed across a network.<\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>Another very useful feature is that the user can <a href=\"http:\/\/networkminer.wiki.sourceforge.net\/Keyword+Search\">search sniffed or stored data for keywords<\/a>. NetworkMiner allows the user to insert arbitrary string or byte-patterns that shall be searched for with the keyword search functionality.<\/p>\n<p>A feature the author wants to include in future versions of NetworkMiner is to use statistical methods to do protocol identification (protocol fingerprinting) of a TCP session or UDP data. This means that instead of looking at the port number to guess which protocol is used on top of the TCP\/UDP packet NetworkMiner will identify the correct protocol based on the TCP\/UDP packet content. In this way NetworkMiner will be able to identify protocols even if the service is run on a non-standard port.<\/p>\n<p>You can download NetworkMiner here:<\/p>\n<p><a href=\"http:\/\/sourceforge.net\/project\/showfiles.php?group_id=189429\">NetworkMiner-0.82<\/a><\/p>\n<p>Or you can read more <a href=\"http:\/\/sourceforge.net\/projects\/networkminer\/\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>NetworkMiner is a passive network sniffer\/packet capturing tool for Windows with an easy to use interface. It can detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off-line analysis. NetworkMiner makes use of OS fingerprinting databases from both p0f (by Michal Zalewski) [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[28,1,5,4],"tags":[1704,1054,8858,2191,589,1751,134,8857],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/755"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=755"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/755\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=755"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=755"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=755"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}