Chapter 6 — Network Tools

The Network menu collects every tool for looking at networks, traffic, and hosts. Camera-related items are split into their own submenu and have their own chapter (Chapter 10).

At a glance

Every Network tab is a feature tab (pinned right of the connection tabs). They do not need a connection tab open.

Port Scanner

Open from Network → Port Scanner.

The classic feature: type a host (or CIDR), tick TCP / UDP, pick a port range, click Scan. Results stream into a table with columns Host, Port, Protocol, State, Service.

Options worth knowing:

• Quick / Common / All — quick scans top 100 ports, common scans top 1000, all scans 1-65535. The first two are seconds; the last is minutes.
• Concurrency — default 200. Lower if your network kit drops packets under load.
• Save Results… — exports CSV or JSON.

Right-click a result row to:

• Open a connection tab to that host on that port.
• Send the host to Host Discovery for OS fingerprinting.
• Copy the host:port.

The scanner does not spoof or send malicious payloads. It is a TCP connect() scan plus optional UDP probes — entirely friendly traffic. Even so, do not scan networks you do not own or have written permission to.

Network Topology

Open from Network → Network Topology.

Builds a live graph of devices it can see on your LAN by ARP-scanning, mDNS-scanning, and walking SNMP if community strings are set.

• Nodes are devices. Colour codes: green = responsive, yellow = stale, red = unreachable.
• Edges are inferred links (ARP neighbour, SNMP lldpRemTable, MAC-to-port).
• Layout — Force-directed (default), Hierarchical (root at your gateway), Radial.

Click a node to see its details panel — MAC, OS guess, open ports if Port Scanner has visited.

The topology tab spawns a background scanner thread. Closing the tab kills the thread (and reopening it restarts the scan from scratch).

Packet Capture

Open from Network → Packet Capture.

A friendly tcpdump in a window:

• Interface dropdown — picks the NIC.
• Filter — BPF syntax (tcp port 80, host 10.0.0.5, etc.). Hints below the field.
• Start / Stop buttons.
• Live packet list, with per-packet decode (Ethernet → IP → TCP/UDP → payload) on click.

Capture buffer is in-memory and capped at 100k packets by default (Settings → Network → Capture Buffer). Save as .pcap exports for Wireshark.

Packet Capture needs admin/root to put the interface in promiscuous mode. On Windows this means launching AidaIDE elevated; on Linux either run elevated or grant CAP_NET_RAW to the Python interpreter.

Traffic Analyzer

Open from Network → Traffic Analyzer.

Watches the same NIC over time and aggregates by host pair:

• Top talkers (sender / receiver / total).
• Per-host bandwidth chart.
• Per-protocol breakdown.
• Top destination ports.

You set the rolling window (1 min / 5 min / 15 min / 1 hr). Data is in-memory only — closing the tab loses it. Export… writes a CSV.

Network Diagnostics

Open from Network → Network Diagnostics.

A one-page diagnostic panel for "is the internet on?" type questions:

• Ping target — default 8.8.8.8. Customisable.
• DNS test — resolves a configurable domain through your current resolver.
• Traceroute — to the same target.
• Gateway test — pings your default gateway.
• Public IP — fetches your apparent public IP.
• MTU probe — finds the largest packet size that survives end-to-end.

Each test is one button; results show in line below. Useful for handing the panel to a non-technical user so they can run the diagnostics and screenshot the result.

Host Discovery

Open from Network → Host Discovery.

A more thorough version of "what is on this LAN?":

1. Enter a CIDR or single host.
2. AidaIDE pings, ARP-resolves, and (optionally) attempts OS fingerprinting via TCP/IP stack quirks.
3. Hits land in the results table.

This tab has historically rendered fabricated/demo data when no real scan is running. If you see entries that look fake (e.g. all-zero MACs, suspiciously round vendor names), confirm by running a fresh scan and watching for the spinner. Demo data is now clearly labelled, but bear it in mind if you see anything weird.

Service Detection

Open from Network → Service Detection.

For each known host (from Host Discovery or a list you supply), opens common ports and grabs the service banner. Returns Service, Version, Vendor when it can.

This is what you run after Host Discovery if you want to know what the open ports are running, not just that they are open.

Common Network workflows

"I need to find the IP of my new Pi on the LAN"

1. Network → Host Discovery with your LAN CIDR (e.g. 192.168.1.0/24).
2. Look for a hostname containing raspberrypi or a MAC starting with Raspberry Pi's prefix.

"Something is hogging my upload bandwidth"

1. Network → Traffic Analyzer on the relevant interface.
2. Watch Top Talkers for a minute. The biggest sender is your culprit.

"I need a pcap for the network team"

1. Network → Packet Capture.
2. Apply a BPF filter to scope the capture (e.g. host 10.0.0.5).
3. Start, reproduce the issue, stop, Save as .pcap.

"What ports are open on this server?"

1. Network → Port Scanner.
2. Enter the host, Common preset, both TCP and UDP, Scan.

Terms & Setup

"I don't have a network to scan" — practice without disturbing real hosts

The Network tools are most fun on a real LAN, but you can try every tab on your own machine without touching anyone else's traffic. Pick the path that fits:

• Scan your own machine (127.0.0.1 / localhost). Port Scanner accepts loopback. Spin up a quick service first — python -m http.server 8080 in any terminal makes port 8080 visible to the scanner. Open / scanned / closed states all behave the way they do on a remote host. Stop the server with Ctrl+C and rescan to see the state flip to closed.
• Scan your own subnet. Your home LAN is fair game (you own it). Find your CIDR with Network → Network Diagnostics → Local IP, then point Host Discovery at e.g. 192.168.1.0/24. You'll see your router, phones, printers, smart-home gadgets — everything that's awake.
• A virtual lab in VirtualBox / VMware / QEMU / Multipass. Spin up two or three small Linux VMs on a host-only network. Each one is a real, isolated target — perfect for Host Discovery, Service Detection, and Packet Capture without risking real production traffic. multipass launch --name lab1 && multipass launch --name lab2 (with Multipass) is the fastest way on macOS/Win/Linux.
• A Docker-Compose toy network. docker compose up a stack with an Nginx + a Redis + a Postgres container; every container is reachable from the host at 127.0.0.1:<published-port>. Port Scanner sweeps the loopback range and Traffic Analyzer watches docker0 / vEthernet (WSL) to see t