WatchYourLAN: Lightweight Network IP Scanner

Speaking about LAN, today, I encountered an unexpected event I had never imagined or experienced before.

I was working on a simple HTML/CSS game in VS Code, with Live Server running on port 5500 to serve the site. Feeling a bit tired, I decided to take a break. I put my Windows PC to sleep and moved to another room in my house. There, I spotted my Android tablet and thought it would be interesting to see how the game would perform on a tablet.

I unlocked the tablet, opened Chrome, entered my PC's local IP address and port, and hit 'Go'. To my surprise, the loading spinner appeared and spun for about 3-4 seconds. I was puzzled as to why the request was taking so long to get a response, and then it hit me—my PC was supposed to be sleeping.

Yet, just as I was processing this realization, the game’s web page loaded on the tablet. I was stunned, thinking, "Wait a minute—didn't I put my PC to sleep?" I went back to check my PC, and sure enough, it was awake but showing the lock screen. Out of curiosity, I repeated the experiment: I put the PC to sleep again, then accessed the webpage from my phone, and, once again, my PC awoke in response to the request. It was an eye-opening moment to see how the network request could wake my PC from sleep!

I googled this behavior and turned out to be called Wake on LAN or, WOL for short [1].

__________________

1. https://learn.microsoft.com/en-us/troubleshoot/windows-clien...

Where do you get your mac->vendor data from? "Hardware" in your screen shot.

Most OUI (MAC) lists I've seen seem to be very incomplete for what ever reason.

FWIW some time ago I coded a more basic CLI tool in a similar vain

What’s nice about it is that it helps you with identify IP of known devices

https://github.com/jmaczan/ktotu

I would love something like this integrated with OpenWRT so it can also get the DHCP hostname. This is usually the most useful bit of information, but the hardest one to get if you're not the router.

I assume this detects "new devices" by its MAC address?

Seems unreliable, with modern devices changing to a new random MAC address frequently.

Then your data would be spammed with new devices constantly?

If only this could call webhooks upon detecting new hardware on the network

When I did more field work, I would use a tool called Look@Lan. This would scan the network and detect common open ports. Similar functionality to nmap, but in a nice gui so you ended up with an interactive list of results.

The ability with look@lan to connect into a client's network and quickly a list of everything reachable on the network was incredible. All the desktops, laptops, printers, etc. When I was doing WISP work, I could quickly see how many clients were online without logging into the far end (nowadays though, most WISPs will enable client isolation, but still good to see the APs and gateways).

Eventually look@lan was discontinued and then they released a tool called Fing, which also worked on mobile. But that turned into a subscription service. I did like the ability of fing to work from a phone, but the earlier Look@Lan was much more useful. I recently helped out a local non-profit who's network was all over the place, split up between two separate access points, each with their own subnet and they were having trouble reaching printers. Nmap helped out, but couldn't find a comparable tool to look@lan to help.

WatchYourLan looks like it will be a good substitute. I know it's primarily designed to run on one network and track changes to said network. And I will probably use it that way at home and a few other places (for the few customers I still maintain, if they permit, I will drop a small Pi/N100 box on their network for remote access and monitoring). But for dropping into a new location, I could see spinning this container up. I could do it in ephemeral mode or setup a data directory per "site" I visit.

There's a few tweaks I could see to make this more "mobile". such as adding a network or "site name" to the DB that you can config and filter on.

Another feature I'd be interested in would be fleshing out the port scanning a bit. Look@Lan and nmap scans for some common ports automatically. WatchYourLan has a port scanner, but you lose the information if you navigate away. At table for port scan results and an option to pre-scan specific ports. This would be good even for the permanent install - some might configure a set of default ports to scan on all the hosts in network, or they might customize for individual hosts.

But those are just my thoughts comparing it to tools I've used in the past. It's already a satisfying tool that's going to be added to my "toolbox". And since I also am a go dev, I might even be able to make some of those a reality.

https://www.ghacks.net/2008/08/11/network-monitoring-softwar...

Cool now tune it with Everything and let it show me data consumption by file||process|egress-addr

https://i.imgur.com/RJYldEq.png

integrate with poly || htop || etc

https://www.ycombinator.com/companies/poly/jobs/L4ObRgn-foun...

and give me a screen of IOs for egress ingress with nifty UFW UI