What is netmon?

NetMon is a local-first network security console built for Windows. It runs from a tray icon with a dashboard you open in a browser at localhost, and it is meant to keep all of your data on your own PC rather than sending it anywhere else. The core features cover discovering devices on your home network with nmap, tracking device history and open ports, checking internet and router connection health, and summarizing captured traffic using Wireshark's dumpcap and tshark tools. It includes a DNS based ad blocker that uses several public blocklists, along with anomaly detection, checks against threat intelligence sources, and firewall actions that can be reversed. A Security Lab section wraps authorized testing tools that run through WSL and Kali Linux, such as Nikto, Hydra, John the Ripper, Metasploit, Aircrack-ng and Shodan lookups. NetMon can also use a locally run AI model through Ollama to help explain what it finds, with optional support for cloud AI providers as a fallback, and it can send push notifications with action buttons through a self hosted service called ntfy. To run it you need Windows 10 or 11, Python 3.10 or newer, and nmap available on your system path, with Ollama, Wireshark and ntfy as optional extras depending on which features you want. Setup is done with a PowerShell script that creates a virtual environment, installs dependencies, copies an example environment file, and prompts you to set a dashboard password. The start script asks for administrator permission because several features, including device discovery, firewall actions and DNS binding on port 53, need it. On startup NetMon tries to automatically detect your network adapter, gateway and subnet, or you can set a specific address range manually in the configuration file. The README is explicit about privacy: runtime data such as the database, packet captures, uploaded files and blocklist caches stay local and are excluded from version control, and any API keys or notification passwords should be kept in a private, gitignored configuration file rather than committed to the repository. It also includes a troubleshooting section covering issues like nmap not being found, incorrect scan results, a missing dashboard password, an unconfigured AI provider, port 53 conflicts with the DNS blocker, and ntfy notifications failing to reach a phone on the local network.