What is NetworkMiner tool?
NetworkMiner is an open source Network Forensic Analysis Tool (NFAT) for Windows (but also works in Linux / Mac OS X / FreeBSD). NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc.
Is NetworkMiner free?
We specialize in software for network forensics and analysis of network traffic. Our most well known product is NetworkMiner, which is available in a professional as well as free open source version.
How do I run a NetworkMiner?
HowTo install NetworkMiner in Ubuntu Fedora and Arch Linux
- STEP 1: Install Mono.
- Ubuntu (also other Debian based distros like Xubuntu and Kali Linux)
- CentOS/RHEL.
- Fedora.
- ArchLinux.
- Installing Mono Manually.
- STEP 2: Install NetworkMiner wget https://www.netresec.com/?download=NetworkMiner -O /tmp/nm.zip.
What is Xplico used for?
Xplico is a network forensics analysis tool (NFAT), which is a software that reconstructs the contents of acquisitions performed with a packet sniffer (e.g. Wireshark, tcpdump, Netsniff-ng).
What is PCAP Ng?
The PCAP Next Generation Dump File Format (or pcapng for short) is an attempt to overcome the limitations of the currently widely used (but limited) libpcap format.
What is DriveSpy?
DriveSpy. DriveSpy is another DOS-based data acquisition tool developed by Digital Intelligence Forensic Solutions and is available at www.digitalintelligence.com. It provides a built-in sector and cluster Hex Viewer to view data, and it has the ability to create and restore compressed forensic images of partitions.
What are the main features and capabilities of the Xplico tool?
Features
- Protocols supported: HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, IPv6, …;
- Port Independent Protocol Identification (PIPI) for each application protocol;
- Multithreading;
- Output data and information in SQLite database or Mysql database and/or files;
What is packet capture tool?
A packet capture tool (also called a network analyzer) can be used to capture this data for analysis. A network analyzer is a troubleshooting tool that is used to find and solve network communication problems, plan network capacity, and perform network optimization.
What is pcap and PcapNG?
While the pcap format does contain some information about the capture interface, the interface information is part of the common header and not stored on a per packet basis. This issue is solved by pcapng which allows a capture file to define multiple interfaces using “Interface Description Blocks”.
What is networkminer and how does it work?
NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows that can detect the OS, hostname and open ports of network hosts through packet sniffing or by parsing a PCAP file. NetworkMiner can also extract transmitted files from network traffic.
How does networkminer extract files and certificates?
NetworkMiner can extract files and certificates transferred over the network by parsing a PCAP file or by sniffing traffic directly from the network. This functionality can be used to extract and save media files (such as audio or video files) which are streamed across a network from websites such as YouTube.
How does networkminer parse pcap files?
NetworkMiner can also parse PCAP files for off-line analysis. NetworkMiner makes use of OS fingerprinting databases from both p0f (by Michal Zalewski) and Ettercap (by Alberto Ornaghi and Marco Valleri) in order to do as correct passive OS fingerprinting as possible. NetworkMiner also uses the MAC-vendor list from Nmap (Fyodor).
Where can I download the latest version of networkminer?
New versions of NetworkMiner are released exclusively on www.netresec.com since version 2.0 of NetworkMiner. This page on SourceForge is only kept to provide hosting of older versions of the software.