NetworkMiner: when it is the wrong tool

Questions it answers well

Use it when the case file is a pcap and the question is an inventory: which hosts appear, which names were heard, which cleartext files moved, which supported protocol leaked a password. That is a faster read than carving by hand, and it gives a person who will not live in a packet list a defensible picture.

Pair it with Zeek when the same file needs a uid in a pipeline, and with tshark when a reviewer asks for a frame number. The three tools should agree on the addresses. Disagreement is a parser bug or the wrong file, and either one is worth five minutes before you write the finding.

Questions that belong elsewhere

A TCP flag, a sequence number, or one option in frame 441 is tcpdump or tshark. A count of S0 connections over a day of sensor logs is Zeek or the SIEM that stores it. NetworkMiner reads packets, not a folder of conn.log. A continuous watch for the inventory-job fan-out belongs on the sensor, not in a GUI you open after the incident.

A file transferred inside TLS will not come back as that file. Certificate names and SNI may be visible in a current build. The body is not. Decrypting it requires a key log the owner already chose to provide, and even then the field work is tshark's, not a second guess in the Files tab. High-rate live capture is also the wrong job for a case GUI. Capture with tcpdump under the scope, then open the bounded file.

• Frame-level questions go to tshark or tcpdump.
• Multi-day detection goes to Zeek on the sensor.
• Log-only cases have nothing for NetworkMiner to open.
• TLS bodies stay out of the Files tab. Say so and move on.

A worked defensive case

Three questions arrive on the files incident. Which lab hosts are in the pcap, and did any cleartext file move? NetworkMiner answers from Hosts and Files. Did the 10:14 session finish the TCP handshake before the client reset? tcpdump on that pair answers, and NetworkMiner was never going to show Flags [R.]. Should the sensor page the next time 10.8.0.20 fans out S0? That is a Zeek notice on the lab sensor, tested against a later log, not a saved GUI session.

You write the split into the ticket so the next person does not re-open NetworkMiner for the reset or export conn.log into a pcap. Each tool keeps the question it can actually see.

Where this is documented

Netresec positions NetworkMiner as a network forensics tool for captured traffic and extracted artifacts. tcpdump(1), tshark(1), and Zeek's logs cover the questions this GUI does not. The scope still decides which file any of them may open.

Use a host-only lab network, or a capture the owner already handed you. These commands read that file or record a single lab host. They are not a scan of the public internet.

Commands

tcpdump -nn -tttt -r /lab/evidence.pcap -c 30 'host 10.8.0.20 and host 10.8.0.40 and tcp port 443'

zeek-cut -m ts uid id.orig_h id.resp_p conn_state history < /lab/zeek/conn.log