Self-hosted network discovery tool that finds devices on your LAN, labels and groups them, and flags changes over time, with Tailscale support.
1.2K+7 this week64GoMITWell maintainedUpdated 6 days ago
291-Group/LAN-Sheriff
A self-hosted network monitor that shows which external servers your devices connect to, on a live map, without blocking any traffic.
- Stars
- 160
- Forks
- 16
- Open issues
- 4
- Last commit
- 5 days ago
What is it?
LAN Sheriff is an open-source, self-hosted network monitor written in Go. Run the binary and a local web dashboard opens showing the outbound connections your devices make, drawn on a world map with the destination's country, organization, protocol, port and byte counts. It is aimed at people who want to see what smart TVs, phones and other devices send to the internet without configuring capture tools first.
It has two modes. Deputy Mode needs no privileges and attributes each connection on the local machine to the application that opened it. Patrol Mode uses packet capture (libpcap or Npcap) to see other devices' traffic and DNS lookups, but only when the program sits where that traffic passes, such as a router or a mirror port. The dashboard also includes a device roster, a precinct map of devices and destinations, a DNS feed, and a rule-based suspicion list that labels unusual behavior without blocking it.
The tool is passive: it never drops, modifies or answers traffic, and it stores no payloads. Optional peer sharing lets two instances exchange hourly aggregate summaries over an encrypted, mutually authenticated connection, and outbound alerts to webhook, ntfy, Discord or Slack are off unless configured.
Key features
- 01Live world map of outbound connections with country, organization, port and byte counts
- 02Deputy Mode attributes each local connection to the application that opened it, without elevated privileges
- 03Patrol Mode adds DNS visibility and sees other devices' traffic when placed at a router or mirror port
- 04Automatic device discovery with a roster of online state, IP, MAC and manufacturer
- 05Rule-based suspicion list that explains each finding and never blocks traffic
- 06Optional encrypted peer sharing of aggregate summaries between paired instances
Use cases
- Checking which trackers and telemetry endpoints a new smart TV or IoT device contacts
- Spotting a device that starts connecting to servers it has never used before
- Understanding how devices on a home network are connected to the internet
- Running a passive monitor on a Raspberry Pi or home server for weeks at a time
Quick start
- 1
Download the platform binary for your system from the release page
- 2
Run the program; a browser opens with no configuration needed
Things to know
- The binaries are not signed by a certificate authority, so your operating system will show a warning the first time you run them.
- Patrol Mode needs elevated privileges (libpcap or Npcap) and only sees other devices if it sits on the router or a mirror/SPAN port.
- Encrypted DNS (DNS over HTTPS or TLS) is invisible, so Radio Chatter may look empty on modern machines.
- Licensed under AGPL-3.0, a copyleft license whose terms apply if you modify and distribute or host it.
In collections
Topics
#network-monitoring#privacy#self-hosted#homelab#packet-capture#traffic-analysis#dns#security#cli#device-discovery
FAQ
- What is LAN-Sheriff?
- A self-hosted network monitor that shows which external servers your devices connect to, on a live map, without blocking any traffic. LAN Sheriff is an open-source, self-hosted network monitor written in Go. Run the binary and a local web dashboard opens showing the outbound connections your devices make, drawn on a world map with the destination's country, organization, protocol, port and byte counts. It is aimed at people who want to see what smart TVs, phones and other devices send to the internet without configuring capture tools first.
- Is LAN-Sheriff free to use? What license does it have?
- LAN-Sheriff is open source under the AGPL-3.0 license. Check the license terms before using it in commercial products.
- Is LAN-Sheriff still maintained?
- Actively maintained. The last commit to LAN-Sheriff was on Nov 2, 2026.
- What can I use LAN-Sheriff for?
- Checking which trackers and telemetry endpoints a new smart TV or IoT device contacts Spotting a device that starts connecting to servers it has never used before Understanding how devices on a home network are connected to the internet Running a passive monitor on a Raspberry Pi or home server for weeks at a time
- How do I install LAN-Sheriff?
- Download the platform binary for your system from the release page Run the program; a browser opens with no configuration needed
- Where can I get LAN-Sheriff?
- The source code and installation instructions are on GitHub: https://github.com/291-Group/LAN-Sheriff
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
Real-time network traffic visualizer that shows every connection your computer makes, which app is responsible, and where the remote hosts are.
791+119 this week53PythonAGPL-3.0Well maintainedUpdated 18 hours ago
Network traffic monitor that flags communication with known malicious domains, IPs, URLs and User-Agents using indicator lists called trails.
8.7K+8 this week1.3KPythonMITUpdated yesterday
Cross-platform desktop application for monitoring your network traffic, inspecting connections in real time, and exporting PCAP captures.
41.9K+166 this week2KRustApache-2.0Well maintainedUpdated 5 days ago
A curated, de-duplicated hosts file that merges several public blocklists to block ads, trackers, malware, and optional categories on any OS.
31.4K+60 this week2.4KPythonMITWell maintainedUpdated 5 days ago