Download
NetSentinel is a free, open source network monitor and intrusion detection system for Windows. It watches your PC's traffic, learns what's normal for your network, and alerts you to what isn't, with machine-learning anomaly detection alongside rule-based detectors.
It catches port scans, brute force, floods, DNS tunneling and domain-generation bursts, beaconing to command-and-control servers, data exfiltration, ARP spoofing, rogue DHCP and router advertisements, name poisoning and lateral movement. It reads TLS handshakes for the hostname and a JA3/JA4 fingerprint, and matches threat feeds downloaded to your PC: nothing about your traffic is sent out.
Related alerts become incidents, serious ones save the packets behind them, and a local browser dashboard shows it all live. Live capture needs Npcap. The exe is code-signed by James Cupps. MIT licensed.
Features
- Live capture with bandwidth charts and per-process flows
- Machine-learning anomaly detection trained on your own traffic
- Port scans, brute force, floods, DNS tunneling and exfiltration
- Beaconing (command-and-control) detection that survives jitter
- ARP spoofing, rogue DHCP, name poisoning and lateral movement
- TLS hostnames and JA3/JA4 fingerprints from encrypted traffic
- Threat feeds checked on your PC; your traffic never leaves it
- Alerts grouped into incidents, with the packets behind them saved
- Local browser dashboard, plus the desktop app and tray
- Code-signed exe and signed updates
Project Samples
