EXPERIMENT=1
AIM – INTRODUCTION TO BASIC NETWORKING TOOLS :
WIRESHARK AND NETWORK MINER.
What is Wireshark?
Wireshark is the world’s foremost open-source network protocol analyzer, used to capture and
interactively browse traffic on computer networks in real time. It functions as a "packet sniffer"
to troubleshoot network issues, analyze security problems, and debug protocols by displaying
detailed, human-readable packet data.
Key Features and Capabilities:
● Deep Inspection: Analyzes hundreds of protocols, with live data captured from Ethernet,
Wi-Fi, and other media.
● Cross-Platform: Runs on Windows, Linux, macOS, and UNIX.
● Advanced Filtering: Allows users to filter traffic by specific criteria (IP, protocol, port) to
narrow down issues.
● Visualization: Provides graphical network utilization graphs, throughput analysis, and
color-coded rules for easy identification.
● Functionality: Can read/write many capture file formats, allowing for post-capture
analysis.
ITS USES
● Troubleshooting: Identifying network bottlenecks, latency issues, and dropped packets.
● Security: Detecting malicious activity, unauthorized access, and analyzing network
intrusions.
● Development: Debugging protocol implementations and application traffic.
WHAT IS NETWORK MINER?
NetworkMiner is an open source network forensics tool that extracts artifacts, such as files, images,
emails and passwords, from captured network traffic in PCAP files. NetworkMiner can also be
used to capture live network traffic by sniffing a network interface. Detailed information about
each IP address in the analyzed network traffic is aggregated to a network host inventory, which
can be used for passive asset discovery as well as to get an overview of which devices that are
communicating. NetworkMiner is primarily designed to run in Windows, but can also be used in
Linux.
Core Functionalities & Uses:
● File Extraction: Reassembles and extracts files (images, documents, emails) transferred
over HTTP, FTP, SMB, and other protocols.
● Credential Extraction: Detects usernames, passwords, and HTTP/FTP credentials.
● Packet Capture & Analysis: Functions as a passive network sniffer to capture live traffic
or analyze existing PCAP files.
● Host & OS Fingerprinting: Identifies hosts on the network, including their operating
systems, open ports, and MAC addresses.
● Keyword Searching: Allows searching through data for specific keywords.
● Malware Analysis: Used for investigating botnet traffic and analyzing malicious C2
communication.
DIFFERENCE BETWEEN WIRESHARK AND NETWORK MINER
WIRESHARK NETWORK MINER
Wireshark analyzes individual packets NetworkMiner reconstructs sessions and
(micro view) extracts artifacts like files and images
Wireshark requires detailed filtering NetworkMiner presents data in tabs
(Files, Images, Hosts) for quick, automatic
analysis.
Wireshark is ideal for live packet NetworkMiner is better for offline analysis
capturing and troubleshooting. of large PCAP files, providing a quick
summary of what occurred.
Wireshark is complex, showing Network
thousands of rows of traffic Miner is more user-friendly, organizing
data into organized, easy-to-read
categories
Wireshark is free and open-source for all NetworkMiner has a free version
platforms (primarily Windows) and a paid
professional version.