CASE 002 / SECURITY / NETWORK MONITORINGSHIPPED
NetPulse
Real-time network traffic monitor with passive device discovery and OS fingerprinting.
01 · Problem & Constraints
Give an operator a live, legible view of what's actually on their network — including devices that were never explicitly registered.
- Real-time updates without overwhelming the operator
- Passive discovery first, active scanning only as a fallback
02 · Architecture & Flow
Explicit Perimeters & Component Flow
01WebSocket-based live dashboard for connection analytics
02Passive ARP-sniffing device discovery with unknown-device flagging
03Passive OS fingerprinting (TTL, TCP window, MAC OUI, port analysis) with confidence scores
04Background active scans: hostname resolution, TCP port probing, ICMP
Technology Stack
ReactPythonFastAPIWebSocketsNetwork packet analysis
03 · Security Decisions
Trust Boundaries Made Legible
- Discovery defaults to passive, read-only capture
- Confidence-scored fingerprinting rather than unqualified claims
04 · Outcome & Roadmap
Verified Results & Real-World Testing
Validated with 6 documented test cases, all passed.
Next Iterations
Broaden protocol coverage and device-fingerprint confidence scoring over time.