When investigating suspicious network activity, finding the relevant evidence is only half the job. An investigator must also understand how devices communicated, which protocols were involved, and whether files or other useful artifacts can be recovered from the captured traffic.
Two tools that can help with this work are Wireshark and NetworkMiner. Both can analyze packet capture files, but they present network evidence differently. Wireshark focuses on detailed packet and protocol analysis, while NetworkMiner organizes information around hosts and artifacts recovered from network traffic.
For digital forensic investigators, the choice depends on the evidence being examined and the questions the investigation needs to answer.
What Is Wireshark?
Wireshark is an open-source network protocol analyzer that allows investigators to capture and inspect network traffic at the packet level. It supports detailed protocol dissection, display filters, conversation analysis and stream reconstruction.
An investigator can use Wireshark to examine DNS queries, TCP connections, HTTP requests, TLS handshakes and other supported protocols. It also provides tools for identifying communication patterns, investigating connection failures and examining packet contents.
For example, if a workstation repeatedly contacts an unfamiliar external server, an investigator can filter traffic involving that IP address, inspect the relevant packets and examine the surrounding communication.
Wireshark is particularly useful when the investigation requires an explanation of what happened inside a network conversation, rather than simply a list of devices or extracted files.
What Is NetworkMiner?
NetworkMiner is a network forensic analysis tool developed by Netresec. It can analyze saved packet captures and, in supported configurations, passively capture network traffic. Its interface organizes much of the resulting information around hosts and extracted artifacts.
Instead of requiring an investigator to begin with individual packets, NetworkMiner can present information such as host addresses, hostnames, sessions, and files or certificates recovered from supported traffic.
For example, when examining a packet capture containing an unencrypted file transfer, NetworkMiner may identify the transferred file and make it available for examination. The investigator can then inspect the recovered artifact separately.
NetworkMiner is useful when the initial objective is to identify communicating hosts and quickly locate potentially relevant artifacts within a packet capture.
However, extraction depends on the available traffic, supported protocols and the application's capabilities. Encrypted traffic does not automatically become readable merely because it is opened in NetworkMiner.
Wireshark vs NetworkMiner: Key Differences
| Feature | Wireshark | NetworkMiner |
|---|---|---|
| Primary purpose | Detailed packet and protocol analysis | Host-centric network forensics and artifact extraction |
| Main interface | Packet-oriented | Host- and artifact-oriented |
| Protocol inspection | Extensive packet-level dissection | Focused on supported forensic parsing |
| Traffic filtering | Powerful capture and display filters | Different, more workflow-oriented navigation |
| Stream investigation | Detailed stream following and packet inspection | Session-oriented analysis of supported traffic |
| File extraction | Supports exporting certain protocol objects | Can automatically extract supported transferred files |
| Host identification | Can inspect addresses, names and conversations | Presents host information as a central workflow |
| Best suited for | Detailed investigation of network behavior | Rapid examination of hosts and recoverable artifacts |
| Typical workflow | Filter, inspect, correlate and reconstruct | Load capture, review hosts and artifacts, investigate findings |
Wireshark's filtering and stream-analysis capabilities are documented in its User's Guide. NetworkMiner's host-centric workflow and file extraction are described in Netresec's product documentation.
Neither tool is universally better. They address different parts of the investigation.
How to Use Wireshark for Network Forensics
A typical workflow begins with a packet capture file, commonly a .pcap or .pcapng file.
1. Open the packet capture
Launch Wireshark and open the evidence file through File → Open.
Before analyzing it, record the evidence identifier, source, acquisition details and cryptographic hash according to the laboratory's evidence-handling procedure.
2. Identify relevant network traffic
Wireshark's display filters help narrow a large capture to traffic relevant to the investigation.
Examples include:
dnsDisplays DNS traffic.
ip.addr == 192.168.1.10Displays IPv4 traffic to or from the specified address.
tcpDisplays TCP packets.
http.requestDisplays packets identified as HTTP requests, when the traffic is available and dissected as HTTP.
These are display filters, not capture filters. They change which packets are shown; they do not delete the hidden packets from the original capture.
3. Inspect the communication
Select a relevant packet and examine its protocol fields, addresses, ports, flags and timestamps. Follow a supported stream when you need to understand the communication in sequence.
For example, an investigator examining repeated TCP connection attempts may inspect the handshake, connection resets and retransmissions to understand the observed behavior.
4. Correlate the findings
Compare the packets with other available evidence, such as endpoint logs, firewall records and system timestamps. A connection to an unfamiliar address is an observation, not proof that the destination is malicious.
How to Use NetworkMiner for Network Forensics
NetworkMiner is particularly useful when the investigator wants to move quickly from a packet capture to an overview of the hosts and artifacts represented in it.
1. Load the evidence file
Open NetworkMiner and load the relevant packet capture. Work on a controlled forensic copy and preserve the original evidence.
2. Review the Hosts view
Examine the hosts identified in the traffic, including available IP addresses, hostnames and other identifying information.
Use this view to establish which systems appear in the capture and which ones may deserve further examination.
Remember that a network address does not necessarily identify a specific person or physical device. Address assignment, network translation and other factors can complicate attribution.
3. Examine sessions and extracted artifacts
Review the available session information and the Files or other artifact views supported by the installed version.
If a file was transferred through a supported, recoverable protocol, NetworkMiner may extract it for further examination. Record the relevant artifact details and preserve the extracted file as a separate evidence item when appropriate.
4. Validate important findings
An extracted file or identified hostname should not be treated as conclusive evidence without further examination. Where possible, return to the original packet capture in Wireshark to identify the packets supporting the finding.
For official feature details, consult the NetworkMiner documentation.
Investigating a Suspicious File Transfer
Consider a hypothetical investigation in which a packet capture contains traffic between an internal workstation and an external server. The capture appears to include a file download.
Using NetworkMiner: The investigator loads the capture and checks whether the tool identifies the communicating hosts and extracts the transferred file. The recovered artifact can then be examined separately.
Using Wireshark: The investigator filters traffic involving the relevant addresses, identifies the associated connection and inspects the packets to determine how the transfer occurred. If the protocol permits it, the investigator can follow the stream or export the relevant object.
The two approaches answer different questions.
- NetworkMiner: What hosts and potentially relevant artifacts can be identified quickly?
- Wireshark: What packet-level evidence explains the communication and supports the finding?
A sound investigation records the extracted artifact's source, correlates it with the relevant packets and verifies its integrity. The presence of a file transfer alone does not establish malicious intent, successful execution or the identity of the person responsible.
Limitations Investigators Should Understand
Neither tool can recover information that is not present in the available evidence without additional sources or capabilities.
Encryption: HTTPS and other encrypted protocols can conceal application content. Metadata may remain visible, but recovering plaintext generally requires appropriate decryption material or access to an unencrypted representation.
Incomplete captures: Missing packets, capture loss or a capture that begins after a connection was established may prevent complete reconstruction.
Protocol support: Automated extraction and protocol interpretation depend on the tool's supported protocols and the structure of the captured traffic.
Attribution: IP addresses, hostnames and other network artifacts provide investigative leads, not automatic identification of a person.
Evidence integrity: Preserve the original capture, document processing steps, calculate hashes where appropriate and retain the context needed to reproduce important findings.
Can You Use Wireshark and NetworkMiner Together?
Yes. For many investigations, using both is more effective than choosing only one.
A practical workflow is:
- Acquire and preserve the network evidence.
- Load the capture into NetworkMiner to identify hosts and potentially relevant artifacts.
- Open the same capture in Wireshark to investigate the packets supporting important findings.
- Correlate the results with other evidence sources.
- Document the observations, interpretations, limitations and conclusions separately.
This approach combines NetworkMiner's artifact-oriented workflow with Wireshark's detailed packet analysis. It also reduces the risk of treating an automated extraction or an isolated packet as a complete explanation of an event.
Which Tool Should You Choose?
Choose Wireshark when you need detailed protocol analysis, precise filtering, stream inspection and a defensible explanation of network behavior.
Choose NetworkMiner when you want a host-centric overview of a packet capture and a convenient way to identify and examine supported extracted artifacts.
For students learning network forensics, both tools are worth understanding. NetworkMiner can help reveal what a capture contains, while Wireshark helps explain how the underlying communication occurred.
The strongest forensic workflow is not about picking a winner. It is about using the right tool for the question, validating the findings against the original evidence and being explicit about what the evidence can—and cannot—establish.