A watchdog for my own home network

I spend my working life insisting that organisations know what is on their network, and then went home to a house with about twenty connected things and no idea what any of them talked to. That gap bothered me enough to do something about it on a spare mini PC that had been in a drawer since I replaced it. It started as a weekend of packet counting and turned into the thing I now check when the internet feels wrong. It is genuinely for one household.

It solves the problem of not noticing change. Every device gets a fingerprint on first sight and the watchdog tells me when a new one appears, when a known one starts talking to somewhere it never has, or when something starts making a lot more traffic than usual. That is it — no blocking, no filtering, no dashboard I have to visit. The notification arrives, I look, and almost always it is a firmware update. It is for me, and for two friends who run copies.

All of it. The capture, the device fingerprinting, the baselining that decides what counts as unusual, and the notification path. The baselining is the only clever part and it is not very clever — a rolling per-device profile of destinations and volume, with a warm-up period before a device can trigger anything, because otherwise every new device alerts about itself for a week. I also keep it running, which mostly means noticing when the capture stops after a power cut.

It never blocks anything. That was a firm decision — the moment it can break my partner's video call, it is a thing I have to be careful with, and I wanted something I could leave running and ignore. It observes and tells me. I also chose to store only metadata rather than payloads, partly for storage and mostly because a box in my house holding my household's traffic content is a worse risk than the one it protects against. And I kept it to a single Go binary plus a SQLite file so I can move the whole thing to a new machine by copying two files, which I have now done twice.

The first month was unusable because everything alerted. Smart devices talk to a rotating set of cloud endpoints, so 'a destination it has never contacted' fires constantly and legitimately. I worked through several approaches and what finally worked was grouping destinations by their organisation rather than by address, so a device moving between endpoints in the same provider is not news, and only a genuinely new provider is. That cut alerts by something like ninety-five percent and turned it from noise into something I read. It also matches how I would have advised anyone else to do it at work, which was mildly embarrassing to arrive at slowly.

It has told me three things worth knowing in two years: a smart plug that started contacting a host in a country its vendor has no presence in, a television that resumed telemetry after an update I had opted out of, and my own backup job silently sending far more than it should have because a folder had been included by mistake. Two friends run it. It has cost me nothing beyond a mini PC I already had and about four hours a year of maintenance.

Nobody, though one of the friends running it contributed the notification integration he wanted and it is now the one I use. My partner is the reason it does not block anything.