See every connection on your network
Wirewatch plugs into your switch's mirror port and shows which devices are talking to what, where in the world that traffic goes, and what doesn't belong. It runs on a Raspberry Pi or an Ubuntu box, and your data never leaves it.
| Device | Destination | Country | Port |
|---|---|---|---|
| laptop-04 | login.microsoftonline.com | US | 443 |
| nvr-cam-2 | 203.0.113.77 | CN | 8000 |
| accounting-pc | api.businesscentral… | US | 443 |
| nas-01 | 198.51.100.24 | RU | 22 |
| thermostat | pool.ntp.org | US | 123 |
What it shows you
Every device, every destination and every port, counted per hour and kept for 30 days.
Every device on one row
A device's IPv4 and IPv6 addresses are grouped by MAC address, with its vendor, hostname and VLAN. With UniFi connected, you also see the switch port or the access point and Wi-Fi network it's on.
Every destination, by name
Destinations are named from DNS lookups, TLS and HTTP headers, with the country, the network owner (for example "Microsoft Corporation, AS8075") and a category such as streaming, social media or updates.
Alerts for what doesn't belong
A banner appears for traffic to or from outside your home country, for inbound connections from the internet, and for malware, phishing, crypto-mining and stalkerware sites.
Connections nobody answered
Unanswered connection attempts are counted per device and port. A high count usually means a firewall block, a dead server or something scanning your network.
A live world map for the wall
Live connections animate from your building to their destinations. Click any location to see every address, hostname and device behind it. The map works even without internet access.
Your data stays on the box
Only connection details are stored: addresses, ports, counts and names, never the content of your traffic. There's no cloud service, no account and nothing sent to us.
How it works
A switch only shows a device its own traffic, so wirewatch listens on a copy of everything passing your firewall.
-
Mirror your uplink
Set up a mirror (SPAN) port on your core switch that copies the link to your firewall, or put a network tap there.
-
Plug in a Pi or Ubuntu box
Plug one network card into the mirror port to listen and another into a normal port for the dashboard. A Raspberry Pi 4 handles a typical small-office internet connection.
-
Run the installer
One script installs everything, starts the services and prints your dashboard password. Then open the dashboard in your browser.
Two commands to install
There are no pip packages, no Node and no database server to install, just Python 3, SQLite and Wireshark's tshark. The installer is safe to run again and never overwrites your settings.
git clone https://github.com/Midstream-Integrations/wirewatch.git
cd wirewatch && sudo ./install.sh
# then open https://<your-box>/ and sign in as adminQuestions
What hardware do I need?
A switch with a mirror (SPAN) port, or a network tap, and a Raspberry Pi 4 or 5 or any Ubuntu machine with two network ports. On a Pi, the built-in port plus a USB gigabit adapter works. Busy networks may need an x86 machine.
Do I need UniFi?
No. UniFi adds the switch port, access point and Wi-Fi network for each device. Without it, wirewatch reads VLANs from tagged traffic or from a subnet list you provide.
Can it see which websites people visit?
It sees hostnames, such as www.example.com, but not full addresses or page content, because almost all web traffic is encrypted. Devices that use encrypted DNS can hide some names, so those destinations show as bare IP addresses.
Where does the location and category data come from?
IP locations and network owners come from DB-IP's free Lite databases (CC BY 4.0). Website categories come from the Université Toulouse Capitole (UT1) lists (CC BY-SA 4.0). Wirewatch downloads and refreshes them on its own.
Can I look at a capture I took somewhere else?
Yes. Load a saved .pcap or .pcapng file into its own database and browse it in the same dashboard.
Can I monitor any network?
Only use wirewatch on networks you own or are responsible for, and follow your organization's policy on monitoring.
Want it set up for you?
We'll configure the mirror port, install wirewatch, connect UniFi and tune the alerts for your network, then show you how to use it.
Wirewatch is free to use on your own. If you'd rather not spend an afternoon on switch settings, tell us about your network and we'll send a fixed price.