Running NetworkMiner on Mac OS X
The following is a guest blog post written by Jonas Lejon from the Swedish IT security company Triop, which specialize in crypto, reverse engineering and penetration testing.
This guide describes how to get NetworkMiner running on Mac OS X Mavericks (version 10.9.3).
First of all, download NetworkMiner and then go to the Mono downloads page and get the latest version for Mac OS X
After the download of “Mono MRE installer” has completed, just run the installer:
Press “Continue” to proceed installing the Mono Framework using the guided installer.
When the Mono Framework has been installed you can extract the downloaded NetworkMiner zip archive. Then start NetworkMiner from the terminal like this:
$ mono --arch=32 NetworkMiner.exe
Live sniffing with NetworkMiner on Mac OS X
Live sniffing with WinPcap or Raw Sockets is only available when running NetworkMiner in Windows.
However, live sniffing can still be achieved on Mac OSX (as well as in Linux) by using the PCAP-over-IP functionality.
Simply select
Press the “Start Receiving” button and then use tcpdump to do live sniffing and forward all captured packets to NetworkMiner like this:
$ sudo tcpdump -i en0 -s0 -U -w - | nc localhost 57012
The preferred way to use NetworkMiner is, however, to load previously captured packets in a PCAP file and let NetworkMiner dig out all interesting details like transmitted files, images, messages, SSL certificates etc.
For more info on how to run NetworkMiner on other operating systems, please see our previous blog posts HowTo install NetworkMiner in Ubuntu Fedora and Arch Linux and No more Wine - NetworkMiner in Linux with Mono.
UPDATE
Microsoft .NET Windows.Forms GUI applications don't run on 64 bit macOS systems running Mono.
This will cause the application to hang/freeze during startup when the GUI window is about to be rendered, throwing errors such as:
- Unable to start NetworkMiner: An exception was thrown by the type initializer for System.Windows.Forms.WindowsFormsSynchronizationContext
- Unhandled Exception: System.TypeInitializationException: An exception was thrown by the type initializer for System.Windows.Forms.ThemeEngine
$ mono --arch=32 /opt/NetworkMiner/NetworkMiner.exe
We'd like to thank Fredrik Pettai for reporting this issue and Joel Langill for suggesting the workaround.
UPDATE 190627
You can also use homebrew to install mono on macOS like this:
brew update && brew install mono
Posted by Jonas Lejon on Tuesday, 24 June 2014 21:25:00 (UTC/GMT)
Tags: #Mac #macOS #NetworkMiner #Mono #tcpdump #PCAP-over-IP
