Alternatives to NetworkMiner

Network forensics tool that extracts files and credentials from captures. The listings below can replace it for an important use case. Each note says what changes if you switch.

The original

Replacements

Listings that take over the same core job as NetworkMiner.

  • Wireshark

    The network protocol analyser: capture traffic and read it packet by packet, with dissectors for hundreds of protocols.

    Wireshark is a GPL-2.0 packet analyser for Windows, macOS and Linux with dissectors for hundreds of protocols, showing packets rather than a host-centric view of extracted files.

  • Arkime

    Store and search captured network traffic through a web interface.

    Arkime stores and indexes captured sessions in PCAP for searching through a self-hosted web interface on Linux, suited to large captures that need substantial storage.

  • Termshark

    Terminal interface for tshark that feels like Wireshark.

    Termshark offers Wireshark-style packet analysis in a terminal using tshark, useful over SSH on macOS and Linux, but without file and credential reconstruction.

  • Malcolm

    A self-hosted network traffic analysis suite that turns PCAP files, Zeek logs and Suricata alerts into searchable dashboards.

    Malcolm is a self-hosted suite that combines PCAP, Zeek and Suricata data into searchable dashboards, but it is a large multi-container stack needing substantial resources.

Similar software

Related functionality, not a direct replacement.