NetworkMiner: open a capture as a host inventory

Where it sits

NetworkMiner, from Netresec, parses a pcap or pcapng and presents hosts, files, images, sessions, credentials, DNS, and parameters. It does not probe those hosts. A live sniff exists in the product. In this course the input is the lab file you already captured with tcpdump or received under the ticket.

The free edition is the GUI. Command-line scripting is a paid feature, so these lessons use the menus. File, then Open, then the case pcap. Wait until the parse finishes before you trust a count. Opening a capture from a shared drive you are not supposed to read is the same mistake as capturing there.

Check the file, then the screen

Before you open it, file(1) should describe a pcap or pcapng, and a three-line tcpdump or tshark sample should show the hosts you expect. That catches a renamed document and a file from the wrong ticket. NetworkMiner will happily inventory the wrong case.

Start on Hosts. You should see the lab addresses from the ticket, such as 10.8.0.20 and 10.8.0.40, with sessions under them. If the inventory is full of addresses the scope excluded, the capture filter was too wide. Stop and go back to the bounded pcap. Do not investigate the extra hosts because the tool listed them.

• Hosts is an inventory built from traffic that was present, not a scan.
• Sessions group conversations. Frames are still in the pcap if you need a flag.
• The same file remains the input for tshark and Zeek. NetworkMiner does not replace the pcap.
• Close the case when you are done. The tool keeps artifacts on disk.

A worked defensive case

The files ticket's pcap is /lab/evidence.pcap. file(1) says it is a pcap, and tshark -c 3 shows 10.8.0.20 and 10.8.0.40. You open that path in NetworkMiner. Hosts lists those two addresses and the lab resolver 10.8.0.53. No other subnet appears.

You screenshot or export the host list into the case folder and note the tool version. The inventory agrees with the scope, so the later Files and Credentials tabs are worth reading. Had a campus subnet appeared, you would have set this file aside and used the filtered capture instead.

Where this is documented

Netresec's NetworkMiner page describes the host inventory, the artifact tabs, and the difference between the free build and the paid build. file(1) and tshark -c are the sanity check before the GUI.

Use a host-only lab network, or a capture the owner already handed you. These commands read that file or record a single lab host. They are not a scan of the public internet.

Commands

file /lab/evidence.pcap && tshark -r /lab/evidence.pcap -c 3