NetworkMiner
NetworkMiner: A focused Windows-first choice for extracting evidence from PCAP and live captures. Ranked #8 of 30 in Network Protocol Analyzers by our editors (8.4/10); pricing: Free plan; best for PCAP artifact extraction on Windows.
At a glance
- Editor score8.4 / 10
- PricingFree plan
- Best forPCAP artifact extraction on Windows
- Free planYes
- Paid from$1,300/user one-time
- DeploymentDesktop
- Founded2010 · Örsundsbro, Sweden
- Facts checked20 Sep 2026
Where it wins
- Extracts files, images, emails, credentials and certificates from captures
- Supports PCAP parsing, live sniffing and PCAP-over-IP reception
- Builds host inventories with passive asset and protocol discovery
Where it doesn't
- Does not decrypt TLS traffic itself
- Professional pricing starts at $1,300 per license
- Desktop platform coverage is limited to Windows and Linux
Our verdict on NetworkMiner
NetworkMiner is an open-source network forensics and packet-analysis tool for incident responders, SOC analysts, investigators and law-enforcement teams. It analyzes PCAP and other capture data, extracts artifacts such as files, images, emails, credentials and certificates, and builds an inventory of observed hosts. The desktop application supports offline capture analysis, live network-interface sniffing and remote capture through PCAP-over-IP, making it suited to investigations that combine stored evidence with active collection.
Pricing follows a freemium model. A free open-source edition is available. According to the vendor's published plans, the Single User License costs $1,300 per license, is registered to one named employee, remains valid for three years, and includes updates and support for three years. The Corporate License costs $6,500 per license, supports unlimited employees within the registered organization, includes GUI and command-line applications, and is perpetual; updates and support are included during the first year. NetworkMiner Professional adds PcapNG support, packet carving, advanced fingerprinting, exports and optional command-line tooling. NetworkMinerCLI is restricted to the Professional Corporate License.
Its strongest fit is evidence extraction and host discovery rather than TLS decryption. NetworkMiner can identify protocols independently of port numbers, decapsulate protocols, extract X.509 certificates and JA3, JA3S and JA4 fingerprints, and provide CSV, XML, JSON-LD and CASE exports in Professional. It runs on Windows and Linux, with a desktop deployment model and both PCAP and live capture support. The vendor recommends using a separate TLS proxy when decryption is required. Choose NetworkMiner for focused PCAP artifact analysis and forensic extraction; teams needing built-in TLS decryption should choose an alternative.
Your product? Our editors can test NetworkMiner in depth and publish a review, labelled as paid · from $149/mo →
NetworkMiner pricing
All 2 NetworkMiner plans and prices →
NetworkMiner fact sheet
| Free plan | Yes |
|---|---|
| Paid from | $1,300/user one-time |
| Deployment | Desktop |
| Capture sources | Both |
| PCAP support | Yes |
| Traffic decryption | No |
| CLI tools | Yes |
| Remote capture | Yes |
| Flow analysis | Yes |
| Deployment | Desktop |
| Platforms | Windows, Linux |
| Support | |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Pricing | Free plan (source) |
| Website | netresec.com |
| Facts checked | 20 Sep 2026 |
Alternatives to NetworkMiner
- WiresharkA broad, free desktop analyzer for live captures, PCAP files, filtering, and protocol inspection.9.4
- TSharkA free, scriptable Wireshark-based analyzer for live captures, PCAP files, and protocol workflows.9.2
- ScapyA free, programmable toolkit for crafting, capturing, decoding, and analyzing packets.9.0
See all NetworkMiner alternatives →
NetworkMiner vs the competition
- NetworkMiner vs Wireshark
- NetworkMiner vs TShark
- NetworkMiner vs Scapy
- NetworkMiner vs Kismet
- NetworkMiner vs tcpdump
- NetworkMiner vs Arkime
Compare NetworkMiner with any tool side by side →
Also Ranked In
NetworkMiner is ranked in 4 of our directories.
Used NetworkMiner? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used NetworkMiner for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
NetworkMiner is listed in our Network Protocol Analyzers directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/networkminer/"><img src="https://www.itechguides.com/best/badge/networkminer.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update