Project: a Raspberry Pi network monitor for your home or lab

What you will build and what you need

You will build an always-on monitor that answers three everyday questions: is everything up, has anything new joined the network, and what is using the bandwidth? These are the same questions a network operations team asks, so the project is good practice for work and for exams on network monitoring.

Permission matters. Monitoring other people's traffic without authority can break the law, for example the Computer Misuse Act and data protection law in the UK, or equivalent laws elsewhere. Use your own home or lab network, and tell people in your household what is logged.

Design

The Pi sits on the network you want to watch. For uptime and new-device detection it needs only a normal connection. To measure traffic for other devices, connect a second interface to a mirror (SPAN) port on a managed switch. DNS logging is easiest if the Pi also runs your local DNS resolver, such as Pi-hole or Unbound, so every lookup passes through it.

Build steps and code

1. Install the OS, set a static IP such as 192.168.10.5, create a non-default user and enable SSH keys.
2. Install tools: sudo apt install arp-scan vnstat, then run sudo arp-scan --localnet to list current devices.
3. Record the MAC addresses of devices you know in known_macs.txt, one per line.
4. Save the script below as netmon.py and run it as a systemd service so it restarts on boot.
5. Use vnstat -l for live interface traffic and vnstat -d for daily totals.

import subprocess, time, csv, datetime

HOSTS = {"router": "192.168.10.1", "nas": "192.168.10.20", "internet": "9.9.9.9"}
KNOWN = set(open("known_macs.txt").read().split())

def is_up(ip):
    r = subprocess.run(["ping", "-c", "1", "-W", "2", ip], capture_output=True)
    return r.returncode == 0

def neighbour_macs():
    out = subprocess.run(["ip", "neigh", "show"], capture_output=True, text=True).stdout
    macs = {}
    for line in out.splitlines():
        parts = line.split()
        if "lladdr" in parts:
            macs[parts[parts.index("lladdr") + 1].lower()] = parts[0]
    return macs

while True:
    stamp = datetime.datetime.now().isoformat(timespec="seconds")
    with open("uptime.csv", "a", newline="") as f:
        w = csv.writer(f)
        for name, ip in HOSTS.items():
            w.writerow([stamp, name, ip, is_up(ip)])
    for mac, ip in neighbour_macs().items():
        if mac not in KNOWN:
            print(stamp, "NEW DEVICE", mac, ip)   # replace with an MQTT or email alert
            KNOWN.add(mac)
    time.sleep(60)

The neighbour table only lists devices the Pi has recently talked to, so running arp-scan --localnet every few minutes keeps it fresh. Remember that phones use randomised MAC addresses per network, so a "new" device may be a known phone.

Security checklist and improvements

• Protect the monitor: it holds sensitive data about your network. Use SSH keys, automatic updates and a host firewall.
• Least privilege: run the script as a normal user; grant only the capabilities that tools such as arp-scan need.
• Limit retention: rotate CSV and DNS logs, and keep only what you need.
• Do not expose dashboards such as ntopng to the internet; reach them over a VPN.
• Treat alerts as clues: investigate a new MAC address by checking your router's DHCP leases before assuming an intruder.

To go further, send results to the MQTT dashboard, add latency graphs, or install an intrusion detection system such as Suricata on the mirror port in your lab.