Quick Recap from Part 1
In Part 1 we covered what NetworkMiner is, how it differs from Wireshark, how to install it, and the five key tabs — Hosts, Files, Credentials, Sessions, and DNS. In Part 2 we go deeper — advanced filtering techniques, recovering malware artifacts from PCAP files, building a structured investigation workflow, and understanding what NetworkMiner misses so you know when to switch tools.
Advanced Filtering in NetworkMiner
NetworkMiner’s built-in filter bar allows you to narrow results by keyword across all tabs simultaneously. Type a hostname, IP address, filename extension, or protocol name and NetworkMiner will filter matching results in real time. For malware investigations, filter by file extensions commonly used in attacks — .exe, .dll, .ps1, .bat, .vbs, .zip. For credential hunting filter by protocol — FTP, HTTP, Telnet. For C2 investigation filter by suspicious TLDs in the DNS tab — .xyz, .top, .click, .tk. To isolate a specific host’s traffic, right-click any IP in the Hosts tab and select Filter to see only that host’s sessions, files, and DNS activity.
Recovering Malware Artifacts from PCAP
When malware communicates over the network it often downloads additional payloads, sends stolen data, or receives commands — all of which can be captured in a PCAP file and extracted with NetworkMiner. In the Files tab, sort by file type and look for executable files — .exe, .dll files downloaded over HTTP are a strong malware indicator. Check the SHA256 hash shown for each extracted file and submit it to VirusTotal directly. In the Credentials tab, look for encoded or base64 strings in the password field — malware often uses cleartext command and control over HTTP with encoded payloads that appear as credentials. In the DNS tab, long subdomain strings and high-frequency queries to the same domain indicate DNS exfiltration or C2 beaconing.
Building an Investigation Workflow
A structured NetworkMiner investigation follows this order. First, open the PCAP and go to the Hosts tab — build your network map and identify unknown or suspicious IP addresses. Second, check the DNS tab — look for newly registered domains, unusual TLDs, and high-frequency queries. Third, check the Files tab — filter for executables and documents, extract and hash suspicious files. Fourth, check the Credentials tab — identify any cleartext authentication. Fifth, check the Sessions tab — sort by data volume to find large data transfers that could indicate exfiltration. Document your findings at each step before moving to the next — this is both good forensic practice and what the CySA+ exam expects.
NetworkMiner does not decrypt HTTPS or TLS traffic — for encrypted traffic analysis you need Wireshark with the server private key or a SSLKEYLOGFILE from the browser. NetworkMiner does not perform deep packet inspection or protocol dissection — Wireshark is superior for analyzing malformed packets, protocol anomalies, or custom protocols. NetworkMiner does not generate statistical summaries or timeline visualizations — for timeline analysis use Zeek or Suricata logs. NetworkMiner does not alert on threats in real time — it is purely a forensic analysis tool for after-the-fact investigation of captured traffic.
CySA+ Exam Takeaways — Part 2
Advanced NetworkMiner filtering uses the filter bar to search across all tabs by IP, hostname, filename, or protocol. Malware artifacts in PCAP files include downloaded executables, encoded C2 commands appearing as cleartext credentials, and DNS exfiltration patterns. The investigation workflow order is Hosts, DNS, Files, Credentials, Sessions. NetworkMiner cannot decrypt TLS or HTTPS traffic — use Wireshark with private keys for encrypted traffic. For the CySA+ exam, NetworkMiner is a forensic evidence collection tool and understanding its limitations is as important as knowing its capabilities.
