NetSentinel is a comprehensive network diagnostic and security tool designed to identify, analyze, and resolve network issues efficiently. It integrates multiple utilities into one platform, streamlining tasks such as device discovery, traffic analysis, and threat detection.
Key Features:
Device Fingerprinter: Scans your LAN to identify every device by MAC OUI, hostname, and type (e.g., camera, router).
Rogue Bridge Detector: Monitors for unauthorized devices that disrupt network stability.
Broadcast Storm Analyser: Detects and isolates broadcast/multicast packet flooding.
IoT Behavioral Baseline: Learns normal IoT traffic patterns to alert on anomalies like port scanning or suspicious connections.
Root Cause Correlator: Links trace results, storm data, and STP findings into actionable insights.
Connection Stability Monitor: Logs long-term ping data for outage detection and jitter analysis.
Audience & Benefit:
Ideal for IT professionals, network administrators, and tech-savvy users who need a centralized solution to monitor and secure their networks. NetSentinel reduces downtime, improves security posture, enhances network performance, and automates diagnostic tasks. It provides evidence-grade reports for troubleshooting with ISPs or support teams.
Install via winget for automatic updates: winget install NetSentinel.NetSentinel.
README
NetSentinel
Find every device on your network, catch the faults that cause dropouts, and prove an outage to your ISP — all in one local app.
Rogue bridge and broadcast storm detection, ARP spoof monitoring, port scanning and CVE lookup, and continuous stability logging. Free, open-source, and 100% local — no account, no telemetry, no cloud.
62 tools in one app · ~136,000 lines of Python — discovery, monitoring, diagnostics, security audit, automation, and education, in a single local desktop app.
6,492 tests · 15-hour chaos-tested · 100% local · MIT License
Devices — full inventory with IP, MAC, hostname, vendor, model and risk level for everything on the LAN
"Why does my internet drop every 30–45 seconds?"
Rogue Bridge (STP) — captures BPDUs and names the device that stole the root bridge role, a classic cause of repeating short outages
"Is it my ISP or my router?"
Root Cause Correlator — a hop-by-hop ping chain isolates where the loss actually starts, then states a plain-English verdict
"How do I prove this outage to support?"
ISP Accountability Report — traceroute table, packet-loss percentages, DNS latency and a timestamped outage log as one exportable HTML file
"Something is slow and I don't know what"
What's Wrong? — one click sequences DNS, storm, STP and ISP checks, then ranks the findings by likely cause
"Is anything of mine exposed?"
Security Overview — port scan, OS fingerprint, CVE lookup, TLS expiry and credential testing, with a letter grade summarising your posture
"Which app is eating my bandwidth?"
App Traffic and Active Connections — per-application breakdown plus a process-to-socket map with one-click firewall block
"Is someone spoofing my gateway?"
ARP Spoof Watch — real-time detection of the IP–MAC conflicts that indicate an active man-in-the-middle
"Why won't this one service load?"
Service Diagnostics — DNS/TCP/HTTPS/traceroute probes against any host, classifying which layer failed (including "filtered" — blocked despite a healthy ping)
Why this exists
A Google Nest speaker connected via Ethernet was winning the STP root bridge election on a local network. Every 30–45 seconds it forced the router to block its own uplink port and reconverge — producing exactly the intermittent drops and DNS failures ISP helpdesks dismiss as "Wi-Fi interference." Tracking it down required five separate tools and produced no shareable evidence.
NetSentinel handles discovery, Layer 2 detection, long-term logging, and report generation in one place — and exports everything in a format a support technician can actually read.
Replaces: Nmap (device discovery, port scanning), Wireshark (broadcast storm and ARP monitoring), PingPlotter/MTR (stability logging, outage evidence), Wi-Fi analyzer apps, and the manual grind of assembling ISP support documentation.
Layer 2 features (STP detection, ARP monitor, broadcast storm analysis) require Npcap on Windows or libpcap on macOS/Linux. See platform setup notes for full details.
Features
Entries marked † need Administrator plus Npcap on Windows or libpcap on macOS/Linux. Everything else runs unprivileged.
Discover
Device discovery — every device's IP, MAC, hostname, vendor, model, and risk level; vendor lookup via a curated local table, scapy's bundled ~50,000-entry OUI database, and a live API fallback
Network topology map — interactive Cytoscape.js diagram; upgrades to a mesh tree when Deco credentials are configured
ARP spoofing detection † — watches for IP–MAC conflicts that indicate an active MITM attack
Report
Network grade A–F — benchmark across uptime, latency, jitter, DNS speed, download speed, STP health, storm level, and device safety; compared to a "perfect home network" baseline
ISP Accountability Report — traceroute hop table, DNS latency, and timestamped outage log as a standalone HTML file for support escalation
Audit
CVE lookup — cross-references discovered OS and service versions against the NVD database on demand
Threat intelligence and risk scoring — reputation lookups for the addresses your devices talk to, plus a per-device risk score
Rogue DHCP detection and SMB share enumeration — flags unauthorised DHCP servers on the wire and exposed Windows shares
SYN stealth port scanner † — half-open TCP scan; faster and quieter than a connect scan
OS fingerprinting † — infers operating system and version from probe responses; reuses prior port-scan results rather than re-scanning
Credential testing † — checks SSH, SMB, FTP and Telnet for default and weak logins on devices you own
Automate
REST API — read-only local HTTP API at http://127.0.0.1:8765; query devices, alerts, and uptime from Home Assistant or scripts
Automation hooks — shell command triggers on device-down, high RTT, and new-device events
Hardware integrations
10 bundled plugins cover TP-Link Deco, Ubiquiti UniFi, AVM FRITZ!Box, ZTE 5G modem, MikroTik, OpenWrt, Netgear, ASUS, Synology, and Home Assistant. Any Python script that implements get_info() and get_status() becomes a first-class integration — with a Hub card, health tracking, circuit breaker, plugin log console, and sandboxed execution.
Every result maps directly to a protocol covered in CompTIA Network+ and CCNA curricula. Concepts visible in real time on your own network:
ARP — ARP Spoof Watch shows every request and reply; the device table shows your current MAC-to-IP mapping
STP — Rogue Bridge tab captures BPDUs; identifies root bridge, port roles, and reconvergence timing
DNS — DNS & Connectivity graphs resolver latency live; DNS leak test shows which resolver handles your queries
TCP — Port Scanner and Active Connections show handshake outcomes and live socket states per process
DHCP — DHCP Lease Inventory parses the OS lease table; DHCP Rogue Monitor separately flags unauthorized DHCP servers on the wire
ICMP — Stability Logger and Availability History plot RTT and packet loss across days or weeks
Built-in reference material:
Protocol Visualizer — 10-protocol animated diagrams (ARP, DNS, TCP, DHCP, STP, OSPF, NAT, VLAN, TLS, ICMP) using real scan data from your own network (not placeholder addresses)
Lab / Scenario Mode — ten guided exercises with progressive hints, solution reveal, and exportable HTML result reports; earned badges and per-certification objective coverage in the Achievements panel
IP subnet calculator with CIDR reference and subnetting examples
35-term networking glossary accessible via the help button from any page
Quality
6,492 automated tests across 496 test files — detection logic, metric storage, version consistency, UI wiring, encoding hygiene, and CodeQL-prevention gates. All tests are offline; no real network traffic or live devices required.
python -m pytest tests/ -v --tb=short
15-hour chaos soak (July 2026): 31,372 automated UIA interactions across mild, moderate, and wild randomisation levels — a full coverage cycle plus two complete soak laps, bracketed by identical systematic sweeps confirming all 62 pages functional before and after. Zero crashes and zero unhandled exceptions. The single health-monitor restart during the run self-healed in 13 seconds.
Every commit gated by:ruff (unused imports/variables) · mypy (module type errors) · pip-audit (dependency CVEs) · debug_launch.py smoke test (catches PyQt6 runtime errors that only appear when the app actually starts) · CodeQL static analysis on every push.
Architecture
Three strict layers: modules/ holds all detection logic with zero PyQt imports; workers/ are QThread wrappers that emit signals and never touch UI state; ui/ reads from MetricStore and never writes to it directly. Every file write goes through get_app_data_dir() — the installed binary lives in a read-only Program Files directory.
dashboard.py is a thin shell that delegates to six inherited mixins and nine page-factory mixins, each responsible for a single concern. A CI-enforced 780-line budget per module keeps every file readable and independently testable.
The red admin badge on Security Audit pages now only appears when you are not running as Administrator. If you have already elevated, the badge is hidden — it was a warning about something that no longer applied
The Security Audit icon in the left rail now carries an amber dot and a tooltip when NetSentinel is not elevated, so you can see those scans need Administrator without opening the menu first
Fixed a chaos-test harness bug where a random click on "Start minimised to the system tray" left every later test run with no window to drive
