Lantern

https://github.com/ibotzhub/lantern

Local network device monitor: scans your LAN, maps devices by MAC and vendor, keeps history, and alerts when a device you have not seen before shows up.

No cloud. No account. One binary. SQLite for persistence.

quick start

git clone https://github.com/ibotzhub/lantern
cd lantern
go mod tidy
make build

./lantern
# or pick an interface
./lantern --iface wlan0 --interval 60s --port 7777

Then open http://localhost:7777 (macOS: open; Linux / SteamOS: xdg-open).

Or: chmod +x run.sh && ./run.sh (runs ./lantern from this directory; build with make build first).

what it does

• arp and ping sweep on your subnet
• MAC vendor lookup so you see Apple, Samsung, Cisco, rpi, whatever. OUI table in the code
• device registry in sqlite, survives restarts
• first seen last seen how many times
• alerts when a new unknown MAC joins
• nickname devices, add notes, mark trusted
• UI polls every 30 seconds
• single binary, web UI embedded, no separate assets

flags

Flag	Default	Description
--iface	auto	interface like wlan0 eth0
--interval	30s	how often to scan
--port	7777	web UI port
--db	./lantern.db	sqlite path

how scanning works

figures out your interface and subnet (e.g. 192.168.1.0/24). tries arp-scan first if you have it (pacman -S arp-scan on arch). falls back to ping sweep and arp table. upserts everything into sqlite. any new MAC gets an alert

run as a service

edit lantern.service for your interface then

make install

stack

go for the scanner and http api. modernc.org/sqlite so no cgo. vanilla js and css in one html file, embedded with go:embed

extending it

more OUI entries edit internal/fingerprint/oui.go. full IEEE list is huge, you can pull it and generate the map

webhook alerts add a --webhook flag and POST from internal/alert/alert.go

port scan add an endpoint that runs a port scan per device with the net package

email add smtp config and fire on new_device

deps

modernc.org/sqlite for pure go sqlite. mdlayher/arp for raw ARP if you want it. optional system stuff: arp-scan (faster), ping and arp for the fallback sweep

project structure

lantern/
├── cmd/lantern/
│   ├── main.go
│   ├── api.go
│   └── web/
│       └── index.html
├── internal/
│   ├── alert/
│   ├── fingerprint/
│   ├── scanner/
│   └── store/
├── go.mod
├── Makefile
├── lantern.service
└── README.md

license

MIT. Build something with it.