How to Install NetworkMiner in Linux

Erik Hjelmvik

Thursday, 10 April 2025 07:30:00 (UTC/GMT)

How to Install NetworkMiner in Linux

This guide shows how to install the latest version of NetworkMiner in Linux. To install an older NetworkMiner release, prior to version 3.0, please see our legacy NetworkMiner in Linux guide.

STEP 1: Install Mono and GTK2

Mono is an open source cross-platform implementation of the .NET framework, it is needed to run NetworkMiner non-Windows machines. GTK2 is not required, but it provides a more consistent look to the user interface.

Ubuntu / Linux Mint / Kali Linux / Raspberry Pi OS:

sudo apt install mono-devel
sudo apt install libgtk2.0-common

Fedora:

sudo yum install mono-devel gtk2

AlmaLinux / RHEL:

sudo dnf install epel-release
sudo dnf install mono-devel gtk2

Arch Linux:

sudo pacman -S mono gtk2

STEP 2: Install NetworkMiner

                curl -o /tmp/nm.zip https://www.netresec.com/?download=NetworkMiner
                
                sudo unzip /tmp/nm.zip -d /opt/
                
                sudo chmod +x /opt/NetworkMiner_*/NetworkMiner.exe

STEP 3: Run NetworkMiner

                mono /opt/NetworkMiner_*/NetworkMiner.exe --noupdatecheck
              

Image: NetworkMiner running in Linux

Follow these steps to analyze live network traffic:

Click File, Receive PCAP over IP [Ctrl+R]
Click Start Receiving and note the listen TCP port (default is 57012)

Then run this command to sniff network traffic and send a real-time stream of captured packets to NetworkMiner:

                sudo tcpdump -U -w - not tcp port 57012 | nc localhost 57012
              

Change 57012 in the command above if NetworkMiner is listening on a different TCP port.

This PCAP-over-IP technique can also be used to read a real-time packet stream from a remote device. It is also possible to sniff packets from Mikrotik routers by clicking File, Receive TZSP Stream.

STEP 4 (optional): Create Shortcut Command

                sudo bash -c 'cat > /usr/local/bin/networkminer' << EOF
                
                #!/usr/bin/env bash
                
                mono $(which /opt/NetworkMiner*/NetworkMiner.exe | sort -V | tail -1) --noupdatecheck \$@
                
                EOF
                
                sudo chmod +x /usr/local/bin/networkminer

NetworkMiner can now be started like this:

networkminer ~/Downloads/*.pcap

Linux Distros with NetworkMiner

NetworkMiner comes pre-packaged on some Linux distributions, such as REMnux, Security Onion Desktop, CSI Linux and BlackArch.

Image: NetworkMiner running in REMnux

Static Download Link

The https://www.netresec.com/?download=NetworkMiner download link always delivers the latest release of NetworkMiner. If you prefer a static link, that points to a specific version of NetworkMiner, then please use this one: https://download.netresec.com/networkminer/NetworkMiner_3-0.zip

Posted by Erik Hjelmvik on Thursday, 10 April 2025 07:30:00 (UTC/GMT)

Tags: #NetworkMiner #Linux #Ubuntu #Kali

How to Install NetworkMiner in Linux

Recent Posts

Blog Archive

News Feeds