NetScope is an open-source cybersecurity tool that discovers devices on your local network, generates an interactive visual map of all connected devices, and uses a local LLM (via Ollama) to generate a plain-English security risk report. Everything runs 100% offline — no data ever leaves your machine.
graph TB
A[ARP Wake Scan] --> B[Windows ARP Cache]
B --> C[Nmap Deep Scan]
C --> D[(results.json)]
D --> E[Pyvis Graph network_map.html]
F[Color Coding] --> E
D --> G[Ollama API qwen3.6]
G --> H[report.txt]
style C fill:#ff6b6b,color:#fff
style G fill:#7000ff,color:#fff
Data Flow: ARP discovery → Nmap scan → CVE + MAC vendor lookup → results.json → (Visualization + AI Report + Diff Monitor)
- Hybrid Discovery: Custom ARP-wake + Nmap hybrid scan finds hidden devices (phones, IoT) that standard scanners miss
- MAC Vendor Fingerprinting: Bundled IEEE OUI CSV identifies device manufacturers and flags potentially spoofed MAC addresses
- CVE Correlation: Real-time vulnerability lookups via the NVD API on exposed services
- Scan Diffing: Automatically tracks network changes between scans — new devices, new ports, risk escalations (SOC monitoring pattern)
- Threat Feed Integration: AbuseIPDB correlation flags known malicious IPs against a global threat database
- Visual Mapping: Interactive color-coded HTML network graph (Green = Safe, Orange = Warning, Red = Critical)
- AI Security Analyst: Local LLM analysis with enriched context (CVEs, vendor info, spoofing alerts)
- 100% Private: All scanning and AI processing happens locally. No cloud dependencies
| Component | Technology | Why |
|---|---|---|
| Discovery | python-nmap + ARP sweep |
Finds hidden/steady devices standard scanners miss |
| MAC Fingerprinting | Bundled IEEE OUI CSV (~6MB) | Offline vendor identification without rate limits |
| CVE Lookup | NVD REST API (free, no auth) | Real vulnerability data for exposed services |
| Visualization | Pyvis + HTML5 + Inline SVG | Interactive graph + static management reports |
| AI Analysis | Ollama local LLM (qwen3.6) | Threat intelligence without cloud dependency |
| Scan Diffing | Pure Python delta comparison | SOC monitoring pattern with change tracking |
- Python 3.8+
- Nmap: Download from nmap.org
- Ollama: Download from ollama.com (pull a model:
ollama pull qwen2.5-coder)
cd netscope
pip install -r requirements.txtStep 1: Scan the Network (requires Administrator on Windows for best results):
python scanner.py
# Generates results.json with enriched data (CVEs, MAC vendors)Step 2: Visualize the Network:
# Interactive Pyvis graph (default, drag-and-drop network map)
python visualizer.py
# Management-friendly static HTML report (tables, charts, risk badges)
python visualizer.py --format report -o security_report.html
# Flat CSV for Excel/Sheets analysis
python visualizer.py --format csv -o devices.csvStep 3: Generate AI Report:
python ai_report.py
# Generates report.txt with AI threat analysisStep 4 (Optional): Check for Changes:
python scan_diff.py
# Compares current scan against history, reports deltanetscope/
├── scanner.py # ARP wake + Nmap deep scan with CVE/MAC enrichment
├── visualizer.py # Pyvis interactive graph + management reports (3 output modes)
├── ai_report.py # Local AI threat analysis via Ollama
├── scan_diff.py # Scan delta comparison (SOC monitoring pattern)
├── threat_feed.py # AbuseIPDB threat feed integration
├── ieee_oui.csv # Bundled IEEE MAC vendor lookup table (~6MB)
├── requirements.txt # Python dependencies
└── imgs/ # Screenshot assets
- MAC spoofing heuristic: Scans bundled IEEE OUI CSV and flags unrecognized prefixes as potentially spoofed
- CVE rate limiting: NVD API capped at 5 results per service to avoid abuse
- Offline-first: All data processing happens locally. The only network call is the optional NVD CVE lookup (no auth required)
- Threat feed via AbuseIPDB: Chosen over VirusTotal for volume scanning (1000 free/day vs 4/min rate limit)
MIT
Built with python-nmap, Pyvis, Ollama & NVD API — 2026