NetworkMiner review
A focused Windows-first choice for extracting evidence from PCAP and live captures.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
NetworkMiner is an open-source network forensics and packet-analysis tool for incident responders, SOC analysts, investigators and law-enforcement teams. It analyzes PCAP and other capture data, extracts artifacts such as files, images, emails, credentials and certificates, and builds an inventory of observed hosts. The desktop application supports offline capture analysis, live network-interface sniffing and remote capture through PCAP-over-IP, making it suited to investigations that combine stored evidence with active collection.
Pricing follows a freemium model. A free open-source edition is available. According to the vendor's published plans, the Single User License costs $1,300 per license, is registered to one named employee, remains valid for three years, and includes updates and support for three years. The Corporate License costs $6,500 per license, supports unlimited employees within the registered organization, includes GUI and command-line applications, and is perpetual; updates and support are included during the first year. NetworkMiner Professional adds PcapNG support, packet carving, advanced fingerprinting, exports and optional command-line tooling. NetworkMinerCLI is restricted to the Professional Corporate License.
Its strongest fit is evidence extraction and host discovery rather than TLS decryption. NetworkMiner can identify protocols independently of port numbers, decapsulate protocols, extract X.509 certificates and JA3, JA3S and JA4 fingerprints, and provide CSV, XML, JSON-LD and CASE exports in Professional. It runs on Windows and Linux, with a desktop deployment model and both PCAP and live capture support. The vendor recommends using a separate TLS proxy when decryption is required. Choose NetworkMiner for focused PCAP artifact analysis and forensic extraction; teams needing built-in TLS decryption should choose an alternative.
NetworkMiner pros and cons
- Where it wins
- Extracts files, images, emails, credentials and certificates from captures
- Supports PCAP parsing, live sniffing and PCAP-over-IP reception
- Builds host inventories with passive asset and protocol discovery
- Where it doesn't
- Does not decrypt TLS traffic itself
- Professional pricing starts at $1,300 per license
- Desktop platform coverage is limited to Windows and Linux
NetworkMiner fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update