Nmap

TapMap is a local network-observability application that monitors a computer's active connections, enriches their IP addresses with GeoIP data, and displays them on an interactive world map. It uses psutil on Windows and Linux or lsof on macOS to scan sockets, extracts IP addresses, performs local GeoIP lookups, and renders the results with Dash and Plotly. TapMap identifies applications and network operators, shows local and unmapped services, and provides application verification details, open-port views, notifications, and MQTT publishing for significant connection events. It maintains a rolling 30-day history covering new and frequent applications, providers, countries, ports, and activity patterns, with a daily activity report. The application runs locally as a web server and is available as Windows, Linux, and macOS desktop distributions, with Docker support on Linux hosts. It states that it collects data locally and sends no telemetry or analytics. TapMap is developed by Ola Lie at TIP Teknologi i Praksis AS and is released under the MIT License.

Fscan is an open-source intranet security scanning tool developed as a Go project. It discovers hosts with ICMP probing, scans TCP ports, identifies services and web technologies, performs credential and hash-based authentication tests, detects selected vulnerabilities and unauthorized access, and provides exploitation and local information-gathering modules. Its inputs include IP addresses, CIDR ranges, domains, URLs, and batch files; results can be written as TXT, JSON, or CSV. The tool is organized around service, web, and local plugins. It supports common service fingerprinting, Xray- and Afrog-format web POCs, DNSLog-based detection, HTTP and SOCKS5 proxies, interface selection, rate and timeout controls, independent scan concurrency settings, and configurable exclusions. Its local modules include system and domain information collection, credential acquisition, persistence mechanisms, shells, security-software detection, and log-cleaning utilities. The repository also provides a Go SDK under pkg/fscan for embedding scan tasks in agents or security platforms, with pause/resume control and progress callbacks, plus an optional web management interface enabled through a build tag.

netmon is a self-hosted local-network monitor that periodically measures download and upload speed, ping latency, ISP, and test-server details, then scans the local subnet with nmap ARP scanning to count active devices. It stores the measurements and device counts in a local SQLite database and uses matplotlib to produce 24-hour trend graphs. The monitor sends status updates and periodic reports to Telegram or Discord. Reports can include sarcastic LLM-generated analysis through an OpenAI-compatible API, including a local LLM server. It runs on macOS or Linux, uses Python and uv, and requires system installations of nmap and speedtest-cli; device counting requires passwordless sudo access for nmap.

NetWatch is a real-time network diagnostics tool that runs in the terminal as a single, configuration-free binary. It captures network activity, attributes connections to processes where available, decodes application-layer protocols, fingerprints clients with JA4, tracks streams, and displays connections, interfaces, packets, protocol statistics, topology, timelines, per-process bandwidth, and egress destinations. Its diagnostic engine learns baselines, applies diagnostic rules, ranks possible causes, and records issues through verified closure. Egress linting observes destinations, promotes policies, and alerts when activity drifts from them; the tool also supports TLS 1.3 decryption for user traffic, PCAP export, display filters, beaconing and DNS-tunneling analysis, and Prometheus metrics. NetWatch provides full, lite, and dense terminal views and can run without elevated privileges for basic information, while capture features may require sudo or Linux capabilities. It is distributed for macOS, Linux, Windows, and other platforms through package managers, binaries, and a container. The repository is MIT-licensed; optional LLM commentary in the Diagnose view is disabled by default.

numbat is an open-source endpoint security tool for monitoring AI-agent activity across supported desktop, CLI, IDE, and gateway agents. It combines local hooks and plugins, OTLP/HTTP logs, and on-disk session artifacts, normalizes live and stored activity into a common event model, and evaluates it locally with built-in, sequence-based, or custom YAML CEL rules. The tool can produce NDJSON events, findings, enforcement decisions, indicators, and scan summaries for alerting and forensic reconstruction, including read-only artifact scans, per-session timelines, and portable case bundles with SHA-256 manifests. Optional pre-action blocking is disabled by default and is limited to supported synchronous hooks and explicitly enforced rules. It is distributed as a single cgo-free binary for macOS, Linux, and Windows, with read-only inventory and scanning commands.