Skip to content

Everything NetMap includes

A complete list of what the app can do. To see it in action, take the visual tour or open the live demo.

flowchart LR
    IN["<b>Inputs</b><br/>Live capture<br/>Open / drag-drop .pcap .pcapng<br/>Sample captures<br/>Command line (main.py)"]
    AN["<b>Analysis</b><br/>Hostnames: DNS · SNI · HTTP · rDNS<br/>Organisation guess<br/>GeoIP location<br/>Service from port<br/>Encrypted / unencrypted<br/>Alert rules · Throughput"]
    UI["<b>Dashboard</b><br/>World map<br/>Overview · Hosts · Host detail<br/>Alerts · DNS · Activity"]
    EX["<b>Exports</b><br/>HTML report · KML<br/>CSV · TXT · JSON"]
    IN --> AN --> UI
    AN --> EX

Inputs

  • Watch live: captures this computer's traffic as it happens. It asks for your password once on macOS and Linux, through the normal system dialog, with no terminal or sudo. On Windows it uses Npcap. You can pick the network interface and an optional capture filter (BPF, e.g. not port 22) from the ▾ menu.
  • Open a capture: use the button or drag a file anywhere on the page. Accepts .pcap, .pcapng and .cap from Wireshark or tcpdump, up to 2 GB.
  • Samples: sample-browsing.pcap (simulated home browsing) and demo-alerts.pcap (synthetic security events), under ⋯ → Sample captures.
  • Command line: python main.py capture.pcapng writes all five reports without opening the UI. It can be limited to one protocol with --protocol tcp|udp|icmp.

Dashboard

  • Map: markers grouped by location and sized by data, coloured by status, with curved lines from "you" that animate during live capture. Click a marker for the hosts there. Use fit-all to see everything, and the Lines toggle to hide the lines.
  • Overview: data, remote hosts, countries, packets, your devices and alerts; a throughput chart; top destinations; services; countries; devices on your network.
  • Hosts: searchable (host, IP, country or service), filterable by status, sortable by data, packets, recency or name.
  • Host detail: location, data sent and received, packets, ports, first and last seen, which of your devices talked to it, a plain-English explanation, its alerts, Show on map, and Who owns this IP? (ipinfo.io).
  • Alerts: most serious first, each explained in plain English.
  • DNS: every name that was looked up, including trackers. Searchable.
  • Activity: a feed of new connections.
  • Status bar: source, duration, and the live packet rate.

Analysis

See How it works for details. Briefly: real hostnames from four sources, about 60 organisation hints, 57 known services, private and carrier-grade NAT detection, IPv6 /64 grouping, two-pass "which addresses are mine" inference for files, and rule-based alerts (port scans, backdoor and risky ports, plaintext protocols, DGA-style domains, DNS tunnelling, large uploads).

Exports

Self-contained HTML report (works offline), KML for Google My Maps or Google Earth, CSV, text summary, JSON.

Privacy and safety

Runs locally on 127.0.0.1. Nothing is uploaded. The admin rights are limited to a 145-line helper. Optional offline mode: --no-ip-lookup --no-rdns.

What's in the repository

.
├── NetMap.command / start.bat / run_dashboard.sh   one-click launchers (auto setup)
├── app.py                 dashboard server (Flask + Socket.IO), live capture, uploads, exports
├── analyzer.py            core engine: decoding, hostnames, GeoIP, alerts, exporters
├── capture_helper.py      tiny root packet sniffer (standard library only)
├── main.py                command-line analyzer
├── templates/index.html   dashboard page (also used for the offline report)
├── static/css, static/js  dashboard styles and logic
├── GeoLiteCity.dat        bundled GeoIP database (IPv4)
├── sample-browsing.pcap   synthetic sample capture (browsing)
├── demo-alerts.pcap       synthetic capture that triggers every alert
├── examples/
│   ├── make_sample_capture.py generates sample-browsing.pcap
│   ├── make_demo_capture.py   generates demo-alerts.pcap
│   ├── pcapgen.py             shared helpers for the generators
│   └── sample-output/         reports produced from sample-browsing.pcap
├── tests/                 pytest suite (19 tests)
├── docs/                  this documentation (also the GitHub Pages site) + screenshots
├── mkdocs.yml             website configuration
├── .github/               CI workflow, issue and PR templates
├── requirements.txt       runtime dependencies
├── requirements-dev.txt   test dependencies
└── LICENSE, THIRD_PARTY_NOTICES.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, CHANGELOG.md