CYBER // SONAR (Network Scanner) | Security Tool by Husain Hakim
CYBER // SONAR is a lightweight, zero-dependency, tactical intranet telemetry appliance designed to discover, track, audit, and visualize every physical device active on your local network in real-time.
Project Overview & Threat Context
CYBER // SONAR is a lightweight, zero-dependency, tactical intranet telemetry appliance designed to discover, track, audit, and visualize every physical device active on your local network in real-time.
Problem Statement & Objective
Understanding what is connected to a local network is the first step in network security. Operating systems don't continuously maintain a complete table of all devices, IP leases change dynamically via DHCP, and modern mobile devices intentionally randomize their Wi-Fi MAC addresses to prevent tracking.
Security Concepts & Principles
- Layer 2 ARP Discovery
- OUI Hardware Fingerprinting
- mDNS & ZeroConf Resolution
- Network Telemetry Auditing
Technologies & Tools
- Python 3
- FastAPI
- SQLite WAL
- HTML5 Canvas
- Asyncio
Technical Architecture & Mechanics
- Scanner Engine: Leverages asyncio and parallel ICMP & socket sweeps to force hosts to respond, then parses the kernel ARP cache to capture authentic physical MAC addresses.
- Identity Resolution: Uses an offline IEEE OUI lookup database to identify hardware vendors and dns-sd/Bonjour to resolve human-readable device names.
- Persistence Layer: Employs SQLite in WAL mode with a custom state-diffing algorithm to track devices across DHCP lease shifts without locking errors.
- Frontend Dashboard: Uses a FastAPI REST core to serve a bespoke cyber-themed tactical UI featuring a 60 FPS HTML5 Canvas Sonar Radar.
Key Capabilities & Features
- Interactive 60 FPS Sonar Topology Radar mapping devices to concentric range rings.
- Device Matrix providing real-time connection status, resolved hostnames, and open ports.
- Device Telemetry Inspector for assigning custom nicknames and categorizing hardware.
- Real-Time Chronological Event Stream tracking device joins, leaves, and IP changes.
- Zero-dependency high-concurrency discovery sweeping a /24 subnet in 1.5 to 3.5 seconds.
CLI Usage Demonstration
# Run the scanner with automatic port detection
$ python3 start.py
# Run on a custom port
$ python3 start.py --port 9000
# Run in headless / server mode (no browser auto-open)
$ python3 start.py --no-browserLessons Learned
- Mastered the distinction between Layer 2 (Data Link) and Layer 3 (Network), using physical MAC addresses as robust primary keys.
- Learned to detect randomized 'Private Wi-Fi Addresses' by inspecting the U/L bit of the MAC address.
- Utilized Multicast DNS (mDNS/Bonjour) to resolve service names without a dedicated local DNS server.
- Engineered a SQLite state diffing engine utilizing WAL mode to prevent database locks during high-frequency parallel writes.
- Built procedural audio synthesizers and optimized HTML5 Canvas coordinate math for a high-performance UI.
Future Roadmap
- Implement passive packet sniffing for silent device detection.
- Integrate automated vulnerability scanning against discovered open ports.
- Add custom webhook alerts for unrecognized device connections.