active scan
Periodically ARP-sweeps your subnet (lanfence scan, or
on an interval inside lanfence monitor), collecting
every MAC/IP that answers.
Defensive network monitoring · v0.3.0
Know who's really on your LAN.
LAN Fence runs on a small Linux box — a Raspberry Pi is the common case — sitting on your network. It continuously scans for connected devices via ARP, maintains an allowlist of devices you already trust, and alerts in plain language when something unknown joins: a rogue device, unauthorized hardware, or a supply-chain implant on your LAN.
It only observes. No blocking, deauthenticating or spoofing — by design.
10 rogue-device signatures · active + passive ARP · Python 3.11+ · Raspberry Pi OS / Debian · MIT
LAN Fence cannot prove a device is malicious
MAC vendor prefixes and hostnames are trivially spoofed by anyone deliberately trying to blend in. A finding is a lead worth checking by hand, not a verdict — use it as one input to your own judgement, and treat every unrecognised device as worth a closer look.
How it works
LAN Fence combines active sweeps with passive listening so a device that joins mid-interval is caught sooner rather than waiting for the next sweep, then checks every device against what you already trust.
passive listen
Between active sweeps, lanfence monitor also listens
for ARP traffic on the wire, catching a device that joins before the
next sweep runs.
device history
Every sighting is folded into a persistent SQLite database keyed by
MAC address: new_device, reappeared or
disconnected.
fingerprinting
An offline OUI vendor lookup, a check against built-in rogue-device signatures, and a check for a locally-administered (spoofed) MAC.
allowlist check
A new or reappearing device not on your allowlist produces a
plain-language finding; an allowlisted device is downgraded to
info.
alerting
Findings can be dispatched to syslog, email or a webhook, and everything is available as a CLI table or JSON for automation.
Watch a scan
A lanfence scan (v0.3.0) — the device
table, then any findings. A trusted network shows
no findings; switch scenarios to see an unrecognised
device raise a MEDIUM finding, or a device matching a
known implant signature raise a HIGH one.
Recorded and reconstructed output, replayed in the browser. LAN Fence never modifies devices on the network.
10 built-in rogue-device signatures
Heuristics, not proof — a match is a lead to check by hand. Extend
or override them with your own rogue_signatures_file: and
vendor_file: in config.
Vendor contains "espressif"
esp32_esp8266
medium
ESP32/ESP8266 Wi-Fi chipset. Extremely common in legitimate IoT (smart plugs, sensors), but also the basis for cheap DIY hidden cameras, rogue access points, and ESP32-based Wi-Fi implants.
Vendor contains "raspberry pi"
raspberry_pi
info
Widely used for entirely legitimate purposes, but also the common hardware basis for network-tap / rogue-implant projects (P4wnP1, home-built taps).
Vendor contains "asix electronics"
usb_ethernet_gadget
medium
USB-to-Ethernet chipset used both by ordinary dongles and by commercial BadUSB / implant tools (Bash Bunny, LAN Turtle, O.MG cable) presenting as a wired adapter.
Hostname contains "pwnagotchi"
pwnagotchi
high
Pwnagotchi, an offensive Wi-Fi handshake-capture tool. Its default hostname is distinctive; a real one on your network is not accidental.
Hostname contains "bashbunny"
bash_bunny
high
Hak5 Bash Bunny, a USB attack platform that can present itself as a network adapter once plugged into a host.
Hostname contains "lanturtle"
lan_turtle
high
Hak5 LAN Turtle, a covert USB-Ethernet implant designed to be left plugged into a network for remote access.
Hostname contains "pineapple"
wifi_pineapple
high
Hak5 WiFi Pineapple, a rogue-access-point / Wi-Fi auditing platform. Legitimate on an authorized pentest; otherwise a strong signal of an unauthorized AP.
Hostname contains "flipper"
flipper_zero
medium
Flipper Zero, a multi-tool device that can also appear on the network via its Wi-Fi dev board add-on.
Hostname contains "omg-cable"
omg_cable
high
An O.MG Cable — a USB cable with an embedded implant that can expose a Wi-Fi access point / network interface for remote control.
Hostname contains "esp32"
esp32_esp8266
info
Suggests an ESP32-based device — the weaker, hostname-only counterpart to the vendor-based ESP32 signature.
Alongside these keyword signatures, any device with no vendor OUI match and a locally administered MAC (the U/L bit set — common for MAC-randomization privacy features, VMs/containers, or spoofed hardware) is flagged as locally_administered_mac, severity info. See the documentation for the full table.
Why teams use it
Evidence, not vibes
Every finding names the exact MAC, IP, hostname and vendor that triggered it, plus the rationale and a recommendation — ready to attach to a ticket.
Active and passive, together
Scheduled sweeps catch what's on the network right now; passive sniffing between sweeps catches a device that joins and leaves before the next one runs.
Remembers what it's seen
A persistent SQLite history tracks every device's lifecycle — new, reappeared, disconnected — so you can tell a genuinely new device from one that's just back online.
Knows the off-the-shelf implants
Matches vendor prefixes and hostnames against signatures for ESP32/ESP8266 gear, Hak5 and O.MG tooling, Pwnagotchi and Flipper Zero — a hit is its own finding.
Signal, not noise
lanfence allow registers devices you trust; findings
about them drop to info, so your own hardware
reconnecting stays quiet.
Alerts your way
Dispatch findings to syslog, email or a webhook, gated by a minimum severity — or just read the CLI table or JSON output.
Rig-friendly
--fail-on-findings gives CI/scripting-style exit codes
(0 / 10 / 20); a sample systemd unit and a cron recipe are included
for unattended running.
Extensible
Add your own vendor entries or rogue-device signatures via plain YAML/text files, merged with the packaged ones — no code changes needed.
Privacy-aware
The device database and allowlist are written atomically and are owner-readable only where the platform supports it. No telemetry, no external calls beyond what you configure.
Honest about its limits
LAN Fence never claims to prove a device is malicious or that a MAC is genuine — every finding is framed as a lead, not a verdict.
Built to be trusted
Open source under MIT, observation-only by design, no telemetry — and a website with zero third-party tracking.
Run a scan in one command
A one-off sweep, or continuous monitoring with alerts.
# Check the host is ready
lanfence check
# One-time active ARP scan
sudo lanfence scan
# Continuous: active sweeps + passive sniffing, with alerts
sudo lanfence monitor --alert
# Trust a device you recognise
lanfence allow 52:8a:1c:99:f4:2d --name "Ross's laptop"Frequently asked questions
Short answers about what LAN Fence is, what it can and cannot do, and how to get it.
What is LAN Fence?
LAN Fence is a free, open-source command-line tool for Linux that watches your network for unauthorized devices. It periodically ARP-sweeps your subnet and passively listens for ARP traffic between sweeps, keeps a persistent SQLite record of every device it has ever seen, fingerprints each one against an offline vendor database and a set of rogue-device signatures, and raises a plain-language finding — with a severity, a rationale and a recommendation — when something unknown joins.
How does LAN Fence detect unknown devices?
Every sighting is folded into a device database keyed by MAC address. A brand-new MAC produces a new_device event; a device that had gone offline and comes back is reappeared; a device an active sweep no longer sees is disconnected. Anything not on your allowlist produces a finding; devices on the allowlist are downgraded to info so your own hardware stops shouting every time it reconnects.
Can LAN Fence prove a device is malicious?
No. LAN Fence cannot prove a device is malicious, or that a MAC address is genuine — MAC vendor prefixes and hostnames are trivially spoofed by anyone deliberately trying to blend in. A finding is a lead worth checking by hand, not a verdict. Use it as one input to your own judgement.
Does LAN Fence block, deauthenticate or interfere with devices?
No. LAN Fence only observes. It sends nothing beyond a standard ARP "who-has" request — the same request every device on your LAN sends routinely — and never touches, blocks, deauthenticates or spoofs anything on the network.
What hardware do I need to run LAN Fence?
A small Linux box sitting on the network you want to watch — a Raspberry Pi is the common case, but any Debian/Ubuntu-like host works. LAN Fence is developed and tested on Raspberry Pi OS and Debian and needs Python 3.11 or newer. Active/passive scanning needs raw-socket access, so scan and monitor typically run under sudo.
What can LAN Fence detect?
Anything that answers an ARP request on the subnet, checked against a small set of built-in rogue-device signatures: Espressif (ESP32/ESP8266) vendor prefixes common in DIY hidden cameras and Wi-Fi implants, Raspberry Pi vendor prefixes (also the common basis for home-built network taps), ASIX USB-Ethernet chipsets used by both ordinary dongles and BadUSB tools like the Bash Bunny, LAN Turtle and O.MG cable, default hostnames used by Pwnagotchi, Flipper Zero and Hak5 tooling, and locally-administered (randomized or spoofed) MAC addresses. Extend or override the signatures and vendor table with your own YAML files in config.
How do I stop LAN Fence flagging my own devices?
Register them with "lanfence allow <mac> --name X". Findings about an allowlisted device are downgraded to info, so repeat sightings of your own hardware stop shouting. "lanfence allow --list" shows the current allowlist and "lanfence allow --remove <mac>" untrusts a device.
Can LAN Fence alert me automatically?
Yes. Findings can be dispatched to syslog, email or a webhook, gated by a configurable minimum severity. "lanfence monitor" runs continuously (active sweeps plus passive ARP sniffing) and dispatches alerts as findings occur; "lanfence scan --alert" dispatches for a single sweep. Run it unattended with systemd (a sample unit is included) or cron.
Does LAN Fence send any data over the network?
No telemetry, no external calls, no phoning home. The only network destinations LAN Fence ever contacts are the ones you configure yourself: your own syslog daemon, your own SMTP relay, or your own webhook URL. The vendor and signature databases are bundled, offline and static.
How much does LAN Fence cost and how is it licensed?
LAN Fence is free and open source under the MIT License, created by Stable State Consulting Ltd. You can read, modify and redistribute the source.
Where do I download LAN Fence?
Install from PyPI with "pipx install 'lanfence[scan]'", or get the source and releases from GitHub. The website hosts documentation only — no binaries.
Watch your LAN today
Install with pipx, and run your first scan in a couple of minutes.