Network Miner Updating on Ubuntu 12.04

I keep a Ubuntu 12.04 build updated and running to stay current with Linux things. Besides a few disk and sector-editing applications, I also keep a copy of Xplico present. Now that Network Miner is supported in Mono on Linux, I run it as well in Ubuntu.

So when Network Miner was recently updated and released at version 1.4.1, I downloaded it in both the Windows binary as well as in my (VirtualBox) Ubuntu system.

• NetworkMiner 1.4 Released - NETRESEC Blog

Only after I got done updating it in Ubuntu, it didn’t start so well.

Unable to start NetworkMiner
Access to the path “/opt/NetworkMiner 1-4-1/AssembledFiles/cache” is denied.

Hmm.

For kicks I relaunched the version 1.3 of NetworkMiner I was previously running and it did fine.

So what the haps Ubuntu/Network Miner?

Turns out it was (again) my noobie Ubuntu skills.

Going back to the original “how-to” post in December 2011 for getting NetworkMiner to work on Linux this is what I did originally to get NetworkMiner working.

First I copied the following text as a block-copy from the post above, making a few minor changes to reflect the new version.

wget sourceforge.net/projects/networkminer/files/latest -O /tmp/networkminer.zip
sudo unzip /tmp/networkminer.zip -d /opt/
cd /opt/NetworkMiner_1-4-1
sudo chmod +x NetworkMiner.exe
sudo chmod -R go+w AssembledFiles/
sudo chmod -R go+w Captures/
mono NetworkMiner.exe

Note I left off the first line of the original text since I had Mono already installed. I also modified the third line above to point to (what I believed) would be the correct build number based on the NetworkMiner-1.4.1 SourceForge.net page.

I then pasted that block text into a terminal session (which has generally worked before) and let it rip.

I thought it did everything required.

I then launched it from the terminal:

mono /opt/NetworkMiner_1-4-1/NetworkMiner.exe

Which got me the error.

I quickly realized my mistake(s).

I was being lazy and copy/pasting the block and expecting it to execute in sequence. In this case…wrong! A review of the terminal output showed that it halted after unzipping the package.

I needed to next manually run the additional commands;

cd /opt/NetworkMiner_1-4-1
sudo chmod +x NetworkMiner.exe
sudo chmod -R go+w AssembledFiles/
sudo chmod -R go+w Captures/
mono NetworkMiner.exe

That did the trick.

If I hadn’t been so excited in trying to get the new version running and had read the NetSec post carefully I would have realized this bit was important:

The reason for setting write permission to the AssembledFiles folder is because this is the directory to where extracted files are written. If you prefer to instead have the files extracted to /tmp or the user's home directory, then simply move the AssembledFiles directory to your desired location and create a symlink to it in the NetworkMiner directory (hat tip to Lenny Zeltser for this idea).

Another way you seem to be able to get it to work without those extra lines is to just run this command after first unzipping to the /opt/ location:

sudo unzip /tmp/networkminer.zip -d /opt/

sudo mono /opt/NetworkMiner_1-4-1/NetworkMiner.exe

Running it in an elevated “sudo” session at first could be “risky” but seems to set the required permissions OK.

Then close it and relaunch it form then on with this command:

mono /opt/NetworkMiner_1-4-1/NetworkMiner.exe

Anyway, it was a noobie Ubuntu user mistake, but hopefully this post will help make future NetworkMiner updates a bit smoother in the future. Just be sure to change the version number in the lines you use above accordingly.

Cheers!

--Claus V.

PS -- I just found this morning upon launching VirtualBox that yesterday Oracle released Virtual Box 4.1.22. ChangeLog

Go download it and the matching “Extension Pack” when you have a chance…