NetSleuth

A project by Qalarc — AI systems studio, Sydney, Australia. Built, shipped and maintained by Qalarc.

Passive network intelligence monitor for the home LAN — in-tree Rust parsers turn a tcpdump stream into a SQLite-backed catalog of every device, site, DNS lookup and SNI handshake, with security heuristics that flag beaconing, DGA patterns and exfiltration-shaped traffic.

Tauri 2RustReact 19TypeScriptSQLiteEChartsLeafletMCP

NetSleuth watches a network without touching it. It pipes a passive packet capture — straight off the router over SSH, from a local interface, or from an imported pcap file — through fully in-tree, zero-dependency Rust parsers for DNS, DHCP, TLS SNI and ARP. Every observation rolls up into SQLite: a device catalog with vendor identification, per-site traffic accounting, hourly timelines, and a heatmap of when the house is actually awake.

The second face of the tool is security. Heuristic analyzers score the traffic for C2-like beaconing regularity, DGA-style domain patterns, raw-IP flows, known malware ports and exfiltration-shaped upload ratios — surfacing plain-English alerts instead of raw packet noise. Wardrive scans map every Wi-Fi AP in range with Wigle geolocation. And because agents are part of the household, NetSleuth also ships an MCP server: any AI assistant can ask 'what joined the network tonight?' and get a real answer.

Capabilities

Passive capture via SSH-to-router tcpdump, local interface, or pcap import — no inline tap needed
In-tree zero-dependency Rust parsers: DNS, DHCP, TLS SNI, ARP, Linux SLL/SLL2
Device catalog with vendor lookup, gateway flag, online status and traffic totals
Security heuristics: beaconing/C2 regularity, DGA patterns, exfil shape, malware ports, blocklist
Hourly traffic timelines, activity heatmap, per-device deep dives
Wardrive Wi-Fi discovery with Wigle + Unwired Labs geolocation
Built-in MCP server so AI agents can query the network directly

NetSleuth

Capabilities

Tags