01 · Product name
NetworkMiner
Carve files from a pcap. Pro is $1,300.
Published by Netresec.
In short
NetworkMiner is Netresec's network-forensics tool. The product page on 18 Oct 2026 says the free edition parses pcap and extracts files, and that Professional adds pcapNG, OSINT lookups, and other rows. Professional is listed at $1,300. Version 3.2 is dated 2026-10-07. The page says the tool runs on Windows and Linux and publishes a source-code download. This listing did not start the application, so it does not describe a host inventory from a run. A carved file is an artifact from the capture, not proof of who requested it.
Product pricing strategy
02
Free and paid
The product page prints two prices. The free edition is Free. NetworkMiner Professional is $1,300. The page says Professional can be an electronic download or a USB drive, and that the software is the same either way. It also says a corporate license is required for some Professional rows in the table. Do not quote $1,300 for the free edition, and do not assume the free edition parses pcapNG. The table says that column is Professional. There is no subscription line on the page opened 18 Oct 2026. Cite the $1,300 cell only for Professional.
Utility and features
03
The Netresec page describes NetworkMiner as an open-source forensics tool that extracts files, images, emails, and passwords from a pcap or from a live interface, and that aggregates hosts. The comparison table marks live sniffing, pcap parsing, IPv6, and several extractors as present in both the free edition and Professional. PcapNG parsing, OSINT lookups of hashes and names, CSV export, and a command-line mode are marked Professional. The price cell for Professional is $1,300. The free edition's price cell is Free. Version 3.2's changelog line is 2026-10-07 and mentions a RADIUS parser.
- Free and $1,300. The table's price cells are Free and $1,300 for Professional.
- pcapNG is a Pro column. The page marks pcapNG parsing, OSINT lookups, and the command line as Professional.
- 3.2 on 7 Oct 2026. The changelog dates NetworkMiner 3.2 to 2026-10-07. The window was not opened here.
The page links an executable download and a source-code download, with SHA256 values on the page. This listing did not download the executable and did not open a window, on Windows or on Linux. The screenshot section is removed for that reason. Do not treat the page's example images as this directory's captures. A password the tool extracts is a credential that appeared on the wire. Repeating it is a separate decision. This listing does not show one.
- 1
Read the free column before you promise a feature that is marked Professional.
- 2
Hash the download against the SHA256 the page prints before you run it.
- 3
Keep carved files in the case store, not in a public screenshot.
Caveats
04
This listing did not run NetworkMiner. There is no file list, no host inventory, and no credential from a local run to quote. The page's screenshots are the vendor's. They are not filed here.
The free edition and Professional differ in the table. A write-up that says NetworkMiner parsed pcapNG or did an OSINT lookup is describing Professional, unless you checked the free column. Version 3.2 is the changelog date 2026-10-07. A Linux run is something the page claims and this listing did not perform. Extracted credentials and files from someone else's capture are evidence-handling problems. Do not paste them into a public page.
Potential use cases
06
- A case needs carved files and someone assumes every column is free. Read the table on the Netresec page. On 18 Oct 2026 the free edition was marked Free and Professional was $1,300. pcap parsing and several extractors were in both columns. pcapNG, OSINT lookups, CSV export, and the command line were marked Professional.
- The download is about to be run. The page prints SHA256 values for the executable and the source archive, and it dates version 3.2 to 2026-10-07. Check the hash the page prints before you start it. This listing did not open the window, on Windows or on Linux, so it has no host inventory to quote.
- A credential appears in a capture someone else made. The page says the tool can extract usernames and passwords. Repeating one is a separate decision. Do not put it in a public note. The page's own pictures are the vendor's. They are not filed here. A corporate license is required for some Professional rows.
Hard cases
The case where the first result is easy to over-read.
A free run is described as pcapNG
The comparison table marks pcapNG parsing as Professional. A write-up of the free edition has to stay inside the free column. $1,300 is the Professional cell, not the free cell. Version 3.2 is the changelog date 2026-10-07. This listing did not start the application, so it does not describe a file list from a local run.
Practitioners using it
Posts on X from people describing a concrete use. The quote is the post. Likes and reposts are the counts saved with it, not a live total. A label marks a creator, a maintainer, a vendor, a partner, a data partner, or an investor.
Creator
Did you know that NetworkMiner parses the #njRAT protocol? The following artefacts are extracted from njRAT C2 traffic: 🖥️ Screenshots of victim computer 📁 Transferred files 👾 C2 commands and replies 🔑 Stolen credentials/passwords ⌨️ Keylog data https://t.co/KHCkADdYO0
Day 18 of #100DaysOfCybersecurity ⚡️ Worked with NetworkMiner today — analyzed captured packets, extracted files, and identified hosts like a real SOC analyst! 🔍💻 @ireteeh @therealbelano @elormkdaniel @cyber_razz @TemitopeSobulo @_DeejustDee @jay_hunts @segoslavia @An_gelos_07 https://t.co/ZWUZUNldSu pic.twitter.com/BPDRpexLrm
Creator
Comparison of files extracted from #PCAP with #Wireshark , @Bro_IDS , #Chaosreader and #NetworkMiner . MD5 sums differ! https://t.co/BG4iW3kVub
Happy New Month from your Cyber Girl. Today I used Wireshark and Networkminer to conduct a Network Hunt on my network. It's an exciting learning experience 😅 #threatintelligence #NetworkHunting #CyberSecurity pic.twitter.com/BmN8ZBbW2f
My new favorite command "editcap.exe -F libpcap infile.pcap outfile.pcap". Great for converting pcap-ng pcaps to old format for NetworkMiner
Questions
Is NetworkMiner free?
The free edition is marked Free. Professional is $1,300 on the page opened 18 Oct 2026. Several columns, including pcapNG, are Professional only.
Did this listing open NetworkMiner?
No. The product page was read. The application window was not started, so the Screenshots section is removed.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
NetworkMiner
https://www.netresec.com/?page=NetworkMinerDocumentation
NetworkMiner source code
https://www.netresec.com/?page=NetworkMinerSourceCode