Is there an example in terms of forensics where Wireshark may be the only method to extract the data for in your .pcap file?


NetworkMiner is a great tool for automatic extraction of files from a packet capture. It's also surprisingly useful and good at extracting messages such as emails. What it isn't any good for is manual packet analysis, which is where Wireshark shines.

See here.

Within that link, it's a short post from reddit with someone who asked a similar question. I feel that was the best answer on there for you, and I have some personal knowledge to include.

Wireshark is a very good tool to analyse packets between your network and a specified network that you're monitoring. It's especially powerful if you know how to identify network protocols such as TCP, DNS, SFTP etc. It's filtering system is also very useful, and as stated in the above quote, NetworkMiner is especially good for message extraction and I also believe it is good for MITM network monitoring.


Yes, there are situations where you will need to resort to using Wireshark, one example is when analysing protocols that aren't supported by NetworkMiner.

One common use of NetworkMiner is extraction of files that have been transferred over a network. The following file transfer protocols are currently implemented in NetworkMiner: FTP, TFTP, HTTP, SMB, SMB2 and SMTP (see official NetworkMiner site). Files transferred over other protocols will therefore not be extracted automatically by NetworkMiner.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.