LAN Sheriff is a self-hosted, open-source network monitoring tool developed by 291 Group, licensed under AGPL-3.0, and free to use. Its main purpose is to let users see what their devices are sending to the internet, where it is going, who owns it, and which activity looks suspicious. All data is processed locally, with no account, no cloud, and no telemetry.
Purpose
Devices continuously send traffic to the internet, and most of it is not initiated by the user—phones, laptops, TVs, thermostats, doorbells, and more quietly send data to servers around the world, including app check-ins, telemetry, trackers, ad networks, and occasionally things that should not be there. LAN Sheriff makes this traffic visible: run a program, the browser opens, and with no setup it shows in real time all connections made from the local machine, their destinations, ownership, and suspicious activity.
The scope of visibility depends on where it runs: running from a router or mirrored switch port covers all devices, and paired instances can cover the rest. Data stays on the user's own machine.
Main Capabilities
- The Watchtower (egress map): A real-time world map that draws lines from the user's location to every external server. Click a destination to view country, city, owning organization (such as AWS, Google, Cloudflare), reverse DNS, protocol, port, byte counts, duration, and the responsible application or device. It marks background communications, beaconing behavior, and first-seen countries. Watch it live or replay history.
- Radio Chatter (DNS stream): A real-time, readable stream of DNS queries showing who queried, the domain, the resolution result, and speed. It shows popular domains, first-seen domains, and queries to known tracker, ad, telemetry, or malware domains (flagged only, not blocked).
- The Precinct Map (network graph): Automatically generates a network graph from observed traffic, with no manual input required. Devices are nodes, connections are links, and links to the external network are grouped and displayed. Each device shows hostname, IP, MAC, manufacturer, inferred type, and open ports.
- The Roster (device inventory): A list of running devices, including online/offline status, first and last seen times, IP, MAC, manufacturer, hostname, type, and services. Devices can be marked, trusted devices can be set as "deputies," or the rest can be placed under surveillance. It alerts when unidentified devices join, and each classification is accompanied by an explanation of the evidence.
- **The Wanted List (suspicious scoring engine): Continuously scores all traffic and generates a ranked list of current suspicious activity, including first contact, beaconing behavior, rare countries or providers, machine-generated (DGA) domains, plaintext where encryption is expected, unusual ports, port scanning, threat list matches, and traffic volumes that break a device's normal pattern. Each flag is explained in plain language and can be manually verified.
How to use
The tool is a single binary and supports Linux, macOS, Windows, and Raspberry Pi. It never blocks, drops, or modifies traffic. There are two modes of automatic detection:
- Deputy mode (default): No special privileges required. Monitors local connections by reading the operating system socket table and associates each connection with the exact application that initiated it.
- Patrol mode (optional): Requires elevated privileges. Passively captures all device traffic passing through its monitoring location, unlocking those devices, full DNS visibility, and automatic network mapping. Must run on a router or a mirror/SPAN port. If patrol privileges cannot be obtained, run deputy mode and inform about the gains that are available.
Device discovery probes: a single paced scan of the local network segment, and on-demand port checks that can also be run manually. It should only be run on networks you own or are authorized to monitor.
The Dispatch (instance pairing): Multiple LAN Sheriff installations can pair with each other and share what each sees, thereby obtaining whole-network visibility without a SPAN port, a mirrored switch port, or running anything on the router. Pairing is explicit: one instance displays a join code, and the user takes it to another instance. New peers are not discovered automatically. Peers exchange aggregated data (endpoints, organizations, countries, applications, counts) over mutually authenticated, encrypted, and pinned-key links; raw details remain on the machine that observed them. Each merged observation records reports its peer, so a peer can be distrusted without unpairing. Disappeared peers turn gray and do not block other peers. Data moves only between machines that the user owns and explicitly pairs, only on the local network, with no server, proxy, or relay.
Other features
Full history of any destination (Rap Sheet): which applications accessed it, traffic, attribution records. Global search for destinations, domains, devices, and applications. Alerts can be sent to a webhook, ntfy, Discord, or Slack (all off by default). Any view can be exported to CSV and JSON. Bounded, self-pruning rolling history, suitable for continuous operation for weeks on a Raspberry Pi. The interfacesupports 12 languages, including right-to-left Arabic and Hebrew.
Use cases
- Discover a new smart TV immediately sending data to multiple tracking companies.
- Learn who devices actually share data with, rather than merely trusting company claims.
- Monitor whether devices have been compromised or have started beaconing to suspicious servers.
- Map in real time what is actually connecting and communicating for a home lab or a large number of devices.
Limitations
- Visibility is limited by where it runs: running from a router or mirror port covers all devices; otherwise the switch shows only local traffic (unless paired).
- Device discovery performs probe scans and may only be run on networks you own or are authorized to monitor.
- It does not block, drop, or modify traffic; it only observes and flags.
- Patrol mode requires elevated privileges; Deputy mode is local-only.
- The website requires JavaScript enabled for full use.
- No specific pricing, paid plans, or performance metrics beyond platform compatibility are provided.
