291 LAN Sheriff
"Nothing leaves town unnoticed."
Your devices are shipping traffic out of town all day. LAN Sheriff is the law around here — a self-hosted, open-source monitor that watches every connection leaving this machine, and, from the right vantage point, every device on your network. It maps where the traffic is headed and flags anything suspicious. All local, no cloud.
The Watchtower — every outbound connection on a live world map. Deputy mode shown; no setup required.
LAN Sheriff
See who your devices really talk to
Developed by 291 Group
Your devices talk to the internet constantly, and almost none of it is you. Phones, laptops, TVs, thermostats, doorbells — all quietly sending data to servers around the world. Apps checking in, telemetry, trackers, ad networks, and occasionally something that shouldn't be there at all. Normally it's invisible.
LAN Sheriff makes it visible. Run one program, a browser opens, and with no setup it shows you — in real time — everything this machine is sending out, where it's going, who owns it, and flags anything suspicious. How much of the network you see depends on where you run it: from your router or a mirrored switch port it covers every device, and paired instances cover the rest. Data stays on your own machines. No account, no cloud, no telemetry.
Live egress map
A world map with lines to every external server your traffic reaches.
Three ways to see the network
Deputy mode needs no privileges, Patrol mode watches every device that passes its vantage point, and paired instances cover what neither can reach on its own.
Yours alone
No account, no cloud, no telemetry. A single binary on Linux, macOS, Windows, and Raspberry Pi. It never blocks, drops, or modifies traffic.
Four Good Reasons
It's genuinely eye-opening — and occasionally, it catches the one thing that doesn't belong.
Curiosity
Plug in a new smart TV and watch it immediately phone home to a dozen tracking companies. Seeing it on a world map is a jaw-drop.
Privacy
Finally see who your devices share data with, instead of taking a company's word for it.
Security
If something gets compromised or a gadget starts beaconing to a sketchy server, this is where you'd see it. That's the sheriff's actual job.
Understand your setup
For a home lab or a pile of devices, it draws a live map of how everything is actually connected and talking.
A Control Tower for Your Network
Everything flying in and out — visible, explained, and ranked by how suspicious it looks.
The Watchtower — egress map
A live world map with lines from you to every external server. Click a destination for country, city, owning org (AWS, Google, Cloudflare…), reverse DNS, protocol, port, bytes, duration, and the responsible app or device. Flags background chatter, beaconing, and never-before-seen countries. Watch live, or scrub back through history and replay what any app was talking to.
Radio Chatter — DNS feed
A live, readable stream of every DNS lookup — who asked, the domain, what it resolved to, how fast. Surfaces top domains, first-time-seen domains, and lookups to known tracker, ad, telemetry, or malware domains (labeled, not blocked).
The Precinct Map — network map
Auto-generates a diagram of your network from observed traffic — no manual input. Devices are nodes, connections are links, plus grouped links out to the internet. Each device shows hostname, IP, MAC, manufacturer, guessed type, and open ports.
The Roster — device inventory
A running list of every device — online/offline, first and last seen, IP, MAC, manufacturer, hostname, type, and services. Label devices, deputize the ones you trust or put the rest on watch. It alerts you when an unrecognized device joins, and every classification explains the evidence behind it.
The Wanted List — suspicion engine What sets it apart
Continuously scores all traffic and produces a ranked list of whatever looks suspicious right now — first contact, beaconing, rare countries or providers, machine-generated (DGA) domains, plaintext where encryption is expected, unusual ports, port-scanning, threat-list matches, and volume that breaks a device's normal pattern. Every flag explains itself in plain language, so it's a judgment you can check — not a black box.
Everything else
A Rap Sheet on any destination — full history, which apps reached it, volumes, and ownership records. Global search across destinations, domains, devices, and apps. Alerts to webhook, ntfy, Discord or Slack (all off by default). CSV and JSON export of any view. Bounded, self-pruning rolling history — safe to leave running on a Pi for weeks. Full interface in 12 languages, including right-to-left Arabic and Hebrew.
Two Modes, Auto-Detected
Complementary rather than a ladder — each sees something the other can't. It picks the right one for your privileges and never leaves you staring at an empty screen.
🎖️ Deputy mode (default)
No special privileges. Watches this machine's own connections by reading the OS socket tables, so it ties every connection to the exact app that made it.
# run as yourself
./sheriff
🚔 Patrol mode (optional)
Elevated access. Passively captures traffic for every device that passes its vantage point — unlocking those devices, full DNS visibility, and automatic network mapping. Give it a vantage point: run it on your router, or on a mirror/SPAN port. Without one, a switch only shows this machine's traffic. If it can't get patrol access, it runs deputy mode and tells you what you'd gain.
# at a vantage point
sudo ./sheriff patrol
Single binary on Linux, macOS, and Windows, including Raspberry Pi. It never blocks, drops, or modifies traffic. And for the corners of a network that no single vantage point can reach, instances pair with each other — that's The Dispatch, below.
Device discovery does probe: it sweeps the local segment once, paced, and there's an on-demand port check you run yourself. Run LAN Sheriff only on networks you own or are authorized to monitor.
The Dispatch
Every deputy reports in, and one console holds the whole picture.
Separate LAN Sheriff installations pair with each other and share what each one sees — so you get whole-network visibility without a SPAN port, a mirrored switch port, or running anything on your router. It's also better than packet capture where it applies: a peer running deputy mode knows exactly which application opened a connection, and that fact is never in the packets.
Off until you say so
No listener, no keypair, nothing exposed until you turn it on. Pairing is explicit — one instance shows a join code and you carry it to the other. It never discovers new peers on its own.
Summaries, not raw traffic
Peers exchange aggregates — endpoint, org, country, app, counts — over a mutually authenticated, encrypted link with pinned keys. Raw detail stays on the machine that observed it.
Attribution is kept
Every merged observation records which peer reported it, so a peer can be distrusted without unpairing. A peer that disappears greys out — it never stalls the others.
Nothing reaches a third party. The Dispatch is local-network only — no server, no broker, no relay, no hole-punching. Data moves only between machines you own and have explicitly paired, and nowhere else.
The Sheriff is Coming to Town
Free, open source under the AGPL-3.0, and built by veterans.