LokiBytes Network Analyzer

A host-based security and network diagnostics tool for Windows. It maps every active network connection back to the process that owns it, flags suspicious activity, gives you one-click tools to investigate or cut off a process's network access, and includes a full Wi-Fi/Bluetooth diagnostics suite - all in a single dark-mode desktop app, no cloud account required.

Formerly named "LokiBytesSecurity". If you have an older checkout or shortcut pointing at that name, update it to LokiBytes Network Analyzer.

Download

The easiest way to run it: grab the prebuilt Windows executable from the Releases page (no Python install required). Since the executable isn't code-signed, Windows SmartScreen may show an "Unrecognized app" warning the first time you run it - click More info -> Run anyway.

For full functionality (passive packet analysis, firewall blocking), right-click the .exe and choose Run as administrator.

Features

• Real-time connection table - every active TCP/UDP connection mapped to its owning process, with executable path, digital-signature status, geolocation/ISP, and a fuzzy-search box to filter instantly.
• Security flagging - rows are flagged ⚠ SUSPICIOUS for unsigned binaries or processes running from common malware-staging directories (Temp, AppData, Downloads, ...).
• Activity & Investigation logs - a live event log plus a dedicated panel for "Investigate Remote IP" reports (geolocation, ISP/ASN, reverse DNS, Tor/VPN/hosting detection, passive OS fingerprint, abuse contact), exportable as text or a structured JSON forensic report.
• One-click response tools - kill a process, block its network access at the Windows Firewall, look up its hash on VirusTotal, or trigger an emergency "lockdown" that kills/blocks every non-system process at once.
• Packet Analysis tab - a full "Advanced Traffic Analyzer": disk-backed packet capture with a filterable, virtually-scrolled table; real-time process attribution; plain-English "Contextual Insights" for any packet; domain resolution (DNS + TLS SNI, so it still works under DNS-over-HTTPS) with a restricted-content flag; an anomaly-delta timeline; a "Blast Radius" hub-and-spoke map; encrypted-traffic heuristics; and one-click remediation (TCP RST injection, firewall IP blocking). See below.
• Macro Topology tab - a Sankey diagram (Process → State → Destination) and a force-directed network map of "This PC", its processes, and the destinations they talk to.
• Traffic Flow tab - a Process → Service → Destination flow diagram and a live connection-count-over-time graph (with a dedicated "Flagged" line).
• Security Analytics tab - an illustrative routing-path diagram (Process → This PC → Gateway → Upstream ASN → Destination) plus protocol/service distribution charts.
• Wireless & Diagnostics tab - see below.
• Passive Network Intrusion Analyzer - an optional Scapy-based sniffer that flags unsolicited inbound connections and Potential-P2P traffic patterns in real time.
• System tray & startup integration - minimize to the tray on close, and optionally launch automatically when you log in to Windows.

See FEATURES.md for the full, detailed feature reference, and HOWTO.md for step-by-step usage walkthroughs and the complete config.json reference.

Wireless & Diagnostics tab

A dedicated module for Wi-Fi and Bluetooth diagnostics, toggled between two modes with a single switch:

Sub-tab	Wi-Fi mode	Bluetooth Only mode
Discovery	Nearby networks: SSID, BSSID, signal, quality, channel, security, band (2.4/5/6 GHz)	Nearby BLE devices (live scan via bleak) and known/paired Classic devices
Channel Rating	0-100 viability score per channel (co-channel/adjacent-channel congestion), top 3 cleanest channels	Environment saturation score from nearby device density
Signal Tracker	Pick a target BSSID; live RSSI, a 60s history trend, and an estimated distance	Same, with live native-rate RSSI streaming for BLE targets
Who's Connected	ARP/ICMP sweep of your LAN: IP, MAC, hostname, OUI vendor	"Piconet" view of locally active Bluetooth profiles (HID, A2DP, Hands-Free, ...)
Speed Test	Latency/jitter/download/upload against Cloudflare's public speed-test backend	Connection-quality probe (latency/jitter/packet loss) against the selected Bluetooth target

Notes and caveats:

• Wi-Fi scanning on Windows requires Location Services enabled (Settings → Privacy & security → Location) and the app running as Administrator - this is a Windows restriction on netsh wlan show networks, not something the app can bypass. If either is missing, the Discovery tab shows a short explanation instead of a silent empty table.
• 6 GHz band detection is exact on Linux (via nmcli's reported frequency) but only a best-effort heuristic on Windows, since netsh doesn't expose raw frequency and 6 GHz channel numbers can collide with 2.4 GHz ones.
• Bluetooth LE discovery requires the optional bleak package (see Installation below). Without it, Bluetooth mode still works using the OS's known/paired Classic device list.
• Bluetooth Classic discovery is a known/paired device list, not a live inquiry scan - that needs raw HCI access that isn't reliably available cross-platform without extra system packages.
• Estimated distances use a standard log-distance path-loss model - treat them as rough estimates, easily skewed by walls/multipath/antenna orientation.

Packet Analysis tab

The "Advanced Traffic Analyzer" - a deeper, disk-backed packet capture and analysis module, with six sub-tabs:

Sub-tab	What it shows
Live Capture	Filterable, virtually-scrolled packet table (SQLite-backed, so long captures don't spike RAM) plus a Contextual Insights panel that translates the selected packet's TCP flags / ICMP type-code / protocol into plain English
Process Attribution	Aggregated bytes/packets per local process, plus a passive neighbor-discovery table (ARP/mDNS/LLMNR/NetBIOS) when using ARP Discovery mode
Anomaly Timeline	A live sparkline of packets/sec with amber/red bands where traffic statistically deviates from its rolling baseline - click anywhere on it to jump Live Capture to that exact moment
Blast Radius	A hub-and-spoke map - this host in the center, remote IPs/domains branching outward, pipe thickness scaled by bytes transferred, color-coded by proxy/hosting/restricted-content flags
ETA Classification	Heuristic categorization of encrypted (TLS) flows by packet-size/timing patterns - e.g. "Media Streaming", "Interactive Shell", "Potential Malware Beaconing"
Remediation	Send a TCP RST to drop an active connection, or block/unblock a remote IP at the Windows Firewall - includes a persistent "Blocked IPs" list so blocked IPs stay visible even after the UAC-elevation restart

Capture modes (dropdown next to "Start Capture"):

• Host (default) - only this machine's own traffic.
• Gateway - also captures transit traffic, for deployment inline as a router (neither endpoint needs to be this host).
• Promiscuous / SPAN - same as Gateway, plus forces the NIC into promiscuous mode to receive traffic mirrored from a switch SPAN/port- mirror port.
• ARP Discovery - zero-config passive neighbor mapping via ARP/mDNS/ LLMNR/NetBIOS broadcasts; doesn't require gateway or mirror placement, but doesn't see other devices' actual traffic content either.

Domain resolution cross-references two independent vectors - plaintext DNS responses and the TLS ClientHello's Server Name Indication (SNI) field - so the destination domain still resolves even when DNS-over-HTTPS hides the DNS query itself. Domains matching a small local keyword list are flagged as restricted/adult content in the table and on the Blast Radius map.

Notes and caveats:

• Requires scapy + Npcap (same as the Passive Network Intrusion Analyzer), and Administrator privileges for full visibility - capture still starts without elevation but may miss traffic.
• ETA classification is a small rule-based heuristic (packet size/timing thresholds), not a trained ML model - treat results as an investigative hint, not a verdict.
• The restricted-content flag is a local keyword match against resolved domains, not a content filter or moderation service - it doesn't block anything, just flags it in the UI.
• Without gateway/mirror placement, this tool can only see this machine's own traffic (Host mode) - it cannot passively see other devices' web browsing on an ordinary switched LAN.
• Captures are stored in packet_capture.sqlite3 next to the app, capped at 300,000 rows (oldest trimmed automatically). Delete that file (with the app closed) to clear all captured data - it's gitignored and never committed.

Installation (from source)

Requirements: Windows 10/11, Python 3.9+.

git clone https://github.com/ITgamers/LokiBytes-Network-Analyzer.git
cd LokiBytes-Network-Analyzer
pip install -r requirements.txt
python main.py

requirements.txt is pinned to exact versions with SHA-256 hashes (generated via pip-compile --generate-hashes), so pip install fails closed if a downloaded package doesn't match what was reviewed.

Optional dependencies (the app runs fine without them, with reduced functionality):

• scapy + Npcap - enables the Passive Network Intrusion Analyzer, the Packet Analysis tab, and the exact (Scapy ARP) variant of the "Who's Connected" LAN sweep. Also requires running as Administrator for full visibility.
• bleak - enables live Bluetooth LE discovery and RSSI tracking in the Wireless & Diagnostics tab. Install with pip install bleak.
• pystray + pillow - enable the system tray (already included in requirements.txt by default).

Recommended: run as Administrator for full visibility into every process's connections, firewall blocking, packet analysis, and the Wi-Fi scanner. Without elevation, the app still runs with an "Administrator: NO" badge and reduced functionality.

Configuration

Copy config.example.json to config.json to customize settings like the refresh interval, VirusTotal API key, or packet-analysis tuning - see HOWTO.md for the full reference. config.json is gitignored so personal API keys are never committed.

Settings (in-app)

Open Settings from the top toolbar:

• Table Font Size - adjusts the connection table's text size.
• System Tray - toggle "Minimize to tray when closing the window" to make the X button hide the app to the tray instead of exiting (monitoring keeps running), or click "Minimize to Tray Now" for a one-off minimize. Requires pystray + pillow.
• Startup - toggle "Run on Windows Startup" to launch the app automatically at login, via the per-user registry Run key (no Administrator privileges needed).
• About - version/branding info.

Building the Windows executable

Releases are built with PyInstaller:

pip install pyinstaller
pyinstaller --noconfirm --onefile --windowed --name "LokiBytes Network Analyzer" --icon assets/lokibytes_icon.ico main.py

The resulting .exe is self-contained (no Python install required on the target machine) and is published to the Releases page for each version.

Documentation

• FEATURES.md - full feature reference.
• HOWTO.md - setup, usage walkthroughs, config.json reference, and known limitations.
• TESTING.md - manual test checklist.

Security & privacy

• All monitoring is local; the only outbound calls are to public lookup services you implicitly request (reverse DNS, ip-api.com geolocation, RDAP/WHOIS, the Tor exit-node list, VirusTotal if you supply an API key, and Cloudflare's public speed-test endpoints) - there is no telemetry and nothing is sent to any LokiBytes-operated server.
• IP investigation only surfaces publicly available network-ownership data (ISP, ASN, approximate geolocation, abuse contact) - it cannot and does not resolve an IP address to a person's name or street address.

Disclaimer

This tool is intended for monitoring and securing systems you own or are authorized to administer. The firewall-blocking, process-termination, and network-diagnostic features can disrupt running software (including your own) if misused - read the confirmation dialogs before using the "lockdown" actions.