Network Intelligence & Security Assessment Tool
A locally-hosted web application that discovers every device on your subnet, analyses nearby WiFi networks, tests latency, scans ports, and automatically flags security vulnerabilities — all from a single browser dashboard.
You set a CIDR range, click Full Scan, and the tool runs all six modules in sequence — device discovery, WiFi enumeration, latency testing, port scanning, security analysis, and export — updating the live dashboard as results arrive.
Clean client-server separation. All computation runs on the Python backend. The JavaScript layer is purely presentational — it calls the API, renders results, and handles downloads.
WiFi Analyser is a network reconnaissance and visibility tool built for authorised network assessment. In a SOC context, maintaining an accurate inventory of devices on your subnet, knowing which ports are exposed, and identifying insecure protocols are baseline requirements that precede any meaningful threat detection work.
The tool fills the gap between heavyweight enterprise scanners and raw command-line utilities — it provides structured, exportable output through a browser interface without requiring a commercial licence or cloud dependency.
The tool uses ARP scanning rather than ICMP ping sweeps for device discovery. Many devices — particularly IoT hardware, mobile phones, and printers — block ICMP at the host firewall level. ARP operates at Layer 2 and cannot be blocked by a host-level firewall: any device that has communicated on the subnet must respond to ARP requests to maintain IP-to-MAC binding.
# Layer 2 ARP broadcast — finds firewalled devices arp_request = ARP(pdst="192.168.1.0/24") broadcast = Ether(dst="ff:ff:ff:ff:ff:ff") answered, _ = srp(broadcast / arp_request, timeout=2) for sent, received in answered: ip = received.psrc # IP from ARP reply mac = received.hwsrc # MAC from Ethernet frame
Sudo/root privileges are required because raw Ethernet frame crafting operates below the OS networking stack. This is expected and documented — the tool clearly states this requirement.
The port scanner uses TCP connect scanning — a full three-way handshake — rather than SYN stealth scanning. This is a deliberate ethical choice: SYN scanning is designed to evade detection and is inappropriate for an authorised audit tool. TCP connect scanning is noisier but more honest, and it accurately represents what an attacker with a standard foothold would find.
All hosts are scanned in parallel using Python's threading module, reducing total scan time from O(hosts × ports × timeout) to O(ports × timeout). A threading lock protects the shared results list from race conditions.
# Parallel scan — one thread per host def scan_ports(ip, ports): for port in ports: sock = socket(AF_INET, SOCK_STREAM) sock.settimeout(0.5) if sock.connect_ex((ip, port)) == 0: open_ports.append(port) # port is open
The tool auto-classifies findings by severity and surfaces them in a dedicated panel. The rules mirror the logic used in enterprise SIEM alerting systems like Splunk and Microsoft Sentinel.
The skills demonstrated here map directly to day-one SOC analyst tasks. Network asset inventory — knowing exactly which devices exist and what services they expose — is a prerequisite for anomaly detection in any SIEM environment.
| Tool feature | SOC / industry equivalent |
|---|---|
| ARP device discovery | Asset inventory, CMDB update, NAC baseline |
| Port scan + service detection | Vulnerability scanning (Nessus, Qualys, Rapid7) |
| Security flag rule engine | SIEM detection rule authoring (SPL, KQL, Sigma) |
| CSV export | Log ingestion, SIEM correlation, evidence packaging |
| Latency monitoring | Network performance baselining, NPM tools |
| WiFi SSID enumeration | Rogue AP detection, wireless IDS |
"Visibility is the foundation of security. You cannot protect what you cannot see — and this tool exists to make the invisible visible."
— Alex Philip, MSc Information Security, Royal HollowayThis tool is designed exclusively for use on networks the operator owns or has explicit written authorisation to test. Unauthorised network scanning is a criminal offence under the Computer Misuse Act 1990 (UK), the Computer Fraud and Abuse Act (USA), and the Information Technology Act 2000 (India).
The tool deliberately omits features that would lower the bar for misuse: there is no SYN stealth scanning, no OS fingerprinting, no vulnerability exploitation, and no credential harvesting. Every scan it performs leaves clear traces in network logs — it is a visibility tool, not an attack framework.