Find every device on your network, catch the faults that cause dropouts, and prove an outage to your ISP — all in one local app.
Rogue bridge and broadcast storm detection, ARP spoof monitoring, port scanning and CVE lookup, and continuous stability logging. Free, open-source, and 100% local — no account, no telemetry, no cloud.
62 tools in one app · ~136,000 lines of Python — discovery, monitoring, diagnostics, security audit, automation, and education, in a single local desktop app.
6,492 tests · 15-hour chaos-tested · 100% local · MIT License
| Discover | Device inventory with vendor/model ID, topology map, Wi-Fi scan, DHCP/DNS-zone mapping |
| Monitor | Live bandwidth, availability history, background stability logger, syslog + SNMP traps |
| Diagnose | One-click "What's Wrong?" triage, Root Cause Correlator, Service Diagnostics |
| Report | Network grade A–F, ISP Accountability Report, one-click network documentation export |
| Audit | Port scan, CVE lookup, TLS monitor, credential testing, OS detection (admin + Npcap) |
| Automate | Read-only REST API, MQTT / Home Assistant, shell hooks, scheduled scans |
| Learn | Interactive protocol visualizer + guided Lab Mode, mapped to CompTIA Network+ / CCNA |
| Your question | Where NetSentinel answers it |
|---|---|
| "What is that unknown device on my Wi-Fi?" | Devices — full inventory with IP, MAC, hostname, vendor, model and risk level for everything on the LAN |
| "Why does my internet drop every 30–45 seconds?" | Rogue Bridge (STP) — captures BPDUs and names the device that stole the root bridge role, a classic cause of repeating short outages |
| "Is it my ISP or my router?" | Root Cause Correlator — a hop-by-hop ping chain isolates where the loss actually starts, then states a plain-English verdict |
| "How do I prove this outage to support?" | ISP Accountability Report — traceroute table, packet-loss percentages, DNS latency and a timestamped outage log as one exportable HTML file |
| "Something is slow and I don't know what" | What's Wrong? — one click sequences DNS, storm, STP and ISP checks, then ranks the findings by likely cause |
| "Is anything of mine exposed?" | Security Overview — port scan, OS fingerprint, CVE lookup, TLS expiry and credential testing, with a letter grade summarising your posture |
| "Which app is eating my bandwidth?" | App Traffic and Active Connections — per-application breakdown plus a process-to-socket map with one-click firewall block |
| "Is someone spoofing my gateway?" | ARP Spoof Watch — real-time detection of the IP–MAC conflicts that indicate an active man-in-the-middle |
| "Why won't this one service load?" | Service Diagnostics — DNS/TCP/HTTPS/traceroute probes against any host, classifying which layer failed (including "filtered" — blocked despite a healthy ping) |
A Google Nest speaker connected via Ethernet was winning the STP root bridge election on a local network. Every 30–45 seconds it forced the router to block its own uplink port and reconverge — producing exactly the intermittent drops and DNS failures ISP helpdesks dismiss as "Wi-Fi interference." Tracking it down required five separate tools and produced no shareable evidence.
NetSentinel handles discovery, Layer 2 detection, long-term logging, and report generation in one place — and exports everything in a format a support technician can actually read.
Replaces: Nmap (device discovery, port scanning), Wireshark (broadcast storm and ARP monitoring), PingPlotter/MTR (stability logging, outage evidence), Wi-Fi analyzer apps, and the manual grind of assembling ISP support documentation.
Windows — three options:
winget install NetSentinel.NetSentinelOr download the installer from the latest release.
macOS / Linux — download the binary from the latest release, or run from source:
git clone https://github.com/ossianericson/netsentinel
cd netsentinel
pip install -r requirements.txt
sudo python app.pyLayer 2 features (STP detection, ARP monitor, broadcast storm analysis) require Npcap on Windows or libpcap on macOS/Linux. See platform setup notes for full details.
Entries marked † need Administrator plus Npcap on Windows or libpcap on macOS/Linux. Everything else runs unprivileged.
- Device discovery — every device's IP, MAC, hostname, vendor, model, and risk level; vendor lookup via a curated local table, scapy's bundled ~50,000-entry OUI database, and a live API fallback
- Network topology map — interactive Cytoscape.js diagram; upgrades to a mesh tree when Deco credentials are configured
- Wi-Fi scan — hidden SSIDs, rogue APs, WPS-enabled networks, co-channel interference, signal levels
- DHCP lease inventory — lists active leases from the OS lease table (for rogue-server detection, see DHCP Rogue Monitor under Audit)
- Full device discovery † — parallel ARP + ICMP + TCP SYN + mDNS sweep
- Background stability logger — continuous ping/RTT/jitter/DNS logging; timestamped CSV evidence; unattended for hours or days
- Availability history — persistent UP/DEGRADED/DOWN charts per device with 1 h / 12 h / 24 h / 7 d zoom
- Live bandwidth chart — 60-second rolling upload/download per interface
- Active connections — process-to-socket map with one-click firewall block/unblock per process
- IoT behaviour baseline — learns normal traffic per IoT device; alerts on port scans, new destinations, and traffic rate spikes
- TLS certificate monitor — hourly expiry checks per host; 30-day pre-expiry alerts
- Per-device bandwidth † — exact rx/tx bps per device via live packet capture
- 802.11 monitor mode † — passive frame capture: probe requests, association frames, deauth frames
- Service diagnostics — DNS/TCP/HTTPS/ICMP/traceroute probes for streaming/gaming services or any custom hostname; failure-layer classification (device → local_network → dns → isp → routing → remote_outage → filtered)
- DNS benchmarking — compares your system resolver against Cloudflare, Google, and Quad9 simultaneously; includes DNS leak test
- Speed test — 3-tier engine: Ookla CLI → speedtest-cli → pure-Python fallback; always works, no forced dependencies
- STP root bridge detection † — captures BPDUs; identifies which device claims the root bridge election on your segment
- Broadcast storm detection † — measures flood levels; pinpoints the source device
- ARP spoofing detection † — watches for IP–MAC conflicts that indicate an active MITM attack
- Network grade A–F — benchmark across uptime, latency, jitter, DNS speed, download speed, STP health, storm level, and device safety; compared to a "perfect home network" baseline
- ISP Accountability Report — traceroute hop table, DNS latency, and timestamped outage log as a standalone HTML file for support escalation
- CVE lookup — cross-references discovered OS and service versions against the NVD database on demand
- Threat intelligence and risk scoring — reputation lookups for the addresses your devices talk to, plus a per-device risk score
- Rogue DHCP detection and SMB share enumeration — flags unauthorised DHCP servers on the wire and exposed Windows shares
- SYN stealth port scanner † — half-open TCP scan; faster and quieter than a connect scan
- OS fingerprinting † — infers operating system and version from probe responses; reuses prior port-scan results rather than re-scanning
- Credential testing † — checks SSH, SMB, FTP and Telnet for default and weak logins on devices you own
- REST API — read-only local HTTP API at
http://127.0.0.1:8765; query devices, alerts, and uptime from Home Assistant or scripts - MQTT / Home Assistant — Discovery payloads, configurable broker, OS-keychain credentials
- Automation hooks — shell command triggers on device-down, high RTT, and new-device events
10 bundled plugins cover TP-Link Deco, Ubiquiti UniFi, AVM FRITZ!Box, ZTE 5G modem, MikroTik, OpenWrt, Netgear, ASUS, Synology, and Home Assistant. Any Python script that implements get_info() and get_status() becomes a first-class integration — with a Hub card, health tracking, circuit breaker, plugin log console, and sandboxed execution.
→ Hardware integrations reference
Every result maps directly to a protocol covered in CompTIA Network+ and CCNA curricula. Concepts visible in real time on your own network:
- ARP — ARP Spoof Watch shows every request and reply; the device table shows your current MAC-to-IP mapping
- STP — Rogue Bridge tab captures BPDUs; identifies root bridge, port roles, and reconvergence timing
- DNS — DNS & Connectivity graphs resolver latency live; DNS leak test shows which resolver handles your queries
- TCP — Port Scanner and Active Connections show handshake outcomes and live socket states per process
- DHCP — DHCP Lease Inventory parses the OS lease table; DHCP Rogue Monitor separately flags unauthorized DHCP servers on the wire
- ICMP — Stability Logger and Availability History plot RTT and packet loss across days or weeks
Built-in reference material:
- Protocol Visualizer — 10-protocol animated diagrams (ARP, DNS, TCP, DHCP, STP, OSPF, NAT, VLAN, TLS, ICMP) using real scan data from your own network (not placeholder addresses)
- Lab / Scenario Mode — ten guided exercises with progressive hints, solution reveal, and exportable HTML result reports; earned badges and per-certification objective coverage in the Achievements panel
- IP subnet calculator with CIDR reference and subnetting examples
- 35-term networking glossary accessible via the help button from any page
6,492 automated tests across 496 test files — detection logic, metric storage, version consistency, UI wiring, encoding hygiene, and CodeQL-prevention gates. All tests are offline; no real network traffic or live devices required.
python -m pytest tests/ -v --tb=short15-hour chaos soak (July 2026): 31,372 automated UIA interactions across mild, moderate, and wild randomisation levels — a full coverage cycle plus two complete soak laps, bracketed by identical systematic sweeps confirming all 62 pages functional before and after. Zero crashes and zero unhandled exceptions. The single health-monitor restart during the run self-healed in 13 seconds.
Every commit gated by: ruff (unused imports/variables) · mypy (module type errors) · pip-audit (dependency CVEs) · debug_launch.py smoke test (catches PyQt6 runtime errors that only appear when the app actually starts) · CodeQL static analysis on every push.
Three strict layers: modules/ holds all detection logic with zero PyQt imports; workers/ are QThread wrappers that emit signals and never touch UI state; ui/ reads from MetricStore and never writes to it directly. Every file write goes through get_app_data_dir() — the installed binary lives in a read-only Program Files directory.
dashboard.py is a thin shell that delegates to six inherited mixins and nine page-factory mixins, each responsible for a single concern. A CI-enforced 780-line budget per module keeps every file readable and independently testable.
→ Architecture reference — design decisions, module inventory, worker table, test architecture
| Track | What it requires | Where to start |
|---|---|---|
| Add a rogue device signature | Edit one JSON file, no Python | offenders.json schema |
| Submit a hardware plugin | Python script, two functions | Hardware plugin guide |
| Code contribution | Full dev setup | Contributing guide |
Zero telemetry. No cloud backend. Every outbound connection is user-initiated and documented.
→ Privacy policy · Security policy and threat model
See CHANGELOG.md for the full release history.
- The red admin badge on Security Audit pages now only appears when you are not running as Administrator. If you have already elevated, the badge is hidden — it was a warning about something that no longer applied
- The Security Audit icon in the left rail now carries an amber dot and a tooltip when NetSentinel is not elevated, so you can see those scans need Administrator without opening the menu first
- Fixed a chaos-test harness bug where a random click on "Start minimised to the system tray" left every later test run with no window to drive
NetSentinel — Network Security Scanner & Connectivity Monitor
NetSentinel will always remain free and open source.
If you find this tool valuable, please consider supporting:
- Wikipedia — free knowledge for everyone
- Electronic Frontier Foundation — protecting digital rights
Built by Ossian Ericson · GitHub
Disclaimer: For use on networks you own or have explicit authorization to test.
MIT — see LICENSE.