Network Monitor
A network monitoring system in Go with an embedded React dashboard: device discovery, threat detection, traffic analysis, and quarantine, packaged as a single binary.
Screenshot unavailable. The project description below explains the workflow.
What it is
Network Monitor watches a home or small-office network: it discovers devices through ARP scanning, enriches them with nmap-driven OS and service fingerprinting, scores each device’s risk, raises alerts, and can quarantine devices - all compiled into a single Go binary with an embedded React dashboard.
The problem it solves
Consumer routers show you a lease table. What you actually want to know is: what is on my network, which devices look risky, and what changed since yesterday. Answering that usually means stitching together separate tools; Network Monitor folds discovery, fingerprinting, risk scoring, alerting, and mitigation into one self-contained system.
My contribution
I designed and built the whole system: the Go scanner and API, the SQLite storage layer, the risk scoring and alerting logic, and the embedded dashboard.
Architecture
- Discovery: configurable ARP scan interval (default 60s) for fast device discovery.
- Deep scan: nmap-powered OS detection, service fingerprinting, and full port scans.
- Identification: MAC OUI vendor database with 300+ manufacturer mappings; automatic classification into device categories.
- Scoring and alerts: per-device risk scores with severity-graded alert history.
- Storage and UI: embedded SQLite and a compiled-in React dashboard; single-binary deployment.
Try the sample
The interactive sample on this site simulates the dashboard with twelve fictional devices and fixed sample data - search, filtering, risk sorting, alert acknowledgement, and topology view all work locally in your browser. It scans nothing and contacts nothing.
Engineering decisions
Single binary, embedded UI. The dashboard compiles into the Go binary, so deployment is copying one file - no node process or web server to babysit.
SQLite for what SQLite is good at. Device history, alerts, and traffic summaries are local, single-writer data; a heavier database would only add operational failure modes.
Risk as a score, not a verdict. Devices get a 0-100 score with bands and reasons, which lets a human decide what matters instead of the tool crying wolf.
Stack
Go, React, SQLite, ARP scanning, nmap integration.