NetScope ⚡

Take control of the local network. Watch it. Manipulate it. Break the connection. Restore it.

NetScope is a desktop network-security lab and observability suite. Once the host is connected to a LAN, NetScope can discover devices and perform active operations against them without asking the target user or device for consent. The software does not verify that the operator owns the network or has permission to test it.

Current application and package version: 0.4.1.

One engine. Two interfaces. Complete local network visibility.

_{The shipped NetScope 0.4.1 desktop interface — captured in Privacy mode.}

Start here

• Install and operate NetScope
• Windows installation
• Linux terminal installation
• First safe scan
• Workspace-by-workspace usage
• Safe shutdown and recovery
• Troubleshooting
• Developer setup

Desktop experience

NetScope uses a responsive Prism Glass Qt Quick interface while keeping every monitoring, discovery, router, interception, and lab workflow available. The application includes:

• Twelve feature workspaces with a collapsible, scroll-safe navigation sidebar.
• Live glass dashboards backed by real controller measurements rather than placeholder telemetry.
• Adaptive device and evidence layouts that keep their controls accessible at the minimum supported window size.
• Native minimize, maximize, restore, title-bar dragging, double-click maximize/restore, and edge/corner resizing for the frameless window.
• A packaged NetScope icon for the application window, taskbar, wheel, and Windows executable builds.
• Keyboard focus styling and reduced-motion support across shared controls.

That means NetScope can be used to:

• Poison ARP caches and disconnect a selected user from the network.
• Become the path between a device and its gateway by enabling IP forwarding.
• Intercept visible device traffic and translate it into readable activity.
• Spoof DNS answers and redirect requests to another IPv4 address.
• Forge and inject custom ARP, ICMP, TCP, and UDP packets.
• Detect scans, discover devices, identify services, and analyze network health.

Caution

NetScope does not magically bypass a Wi-Fi password or breach a network from the outside. The host must already be connected to the network, and active features usually require administrator/root privileges and packet-capture support. However, once those conditions are met, NetScope can attempt disruptive actions even when the affected users have not granted permission. Unauthorized interception, spoofing, redirection, or disconnection may be illegal and can cause data loss or loss of connectivity. Use it only on networks you own or are explicitly authorized to test.

Dangerous controls

Control	What it does	Risk
ARP Blackout	Continuously poisons a target and gateway so the target can lose network access.	Can immediately disconnect a real user.
Ghost Gateway	Uses bidirectional ARP poisoning and attempts to enable host IP forwarding.	Pulls traffic through the NetScope host and changes network state.
Wiretap View	Captures visible traffic for a selected device and turns packets into readable events.	Can expose sensitive domains, endpoints, timing, and usage patterns.
DNS Hijack	Replies to matching DNS queries with an operator-selected IPv4 address.	Can redirect or break websites, applications, updates, and services.
Packet Forge	Builds and transmits custom ARP, ICMP, TCP, and UDP packets.	Malformed, spoofed, or repeated packets can disrupt devices or trigger defenses.
Scan Sentry	Watches visible traffic for SYN, XMAS, NULL, FIN, and UDP sweep patterns.	Defensive only, but visibility is limited to the selected interface.

Advanced ARP lab

The Advanced ARP lab turns individual controls into a traceable experiment: discover → attack → observe → stop → verify recovery → report. Every run locks one module and target, records a timeline, keeps Stop & restore visible, checks that local workers actually stopped, and exports a Markdown report.

Module	Operating profile
Active Recon Engine	Bounded common-service discovery and evidence-based fingerprinting for one private target.
Connection Killer	Target-scoped ARP blackout using the existing poisoning and corrective-restoration engine.
IPv6 Phantom	Observation-only IPv6, NDP, router-advertisement, and link-local visibility. It does not emit rogue IPv6 control traffic.
Rogue Gateway Lab	Transparent ARP interception, host IP forwarding, and live packet observation.
PCAP Arsenal	Bounded in-memory capture with explicit PCAP export. Captures can contain sensitive data.
Cleartext Interceptor	Highlights visible unencrypted protocols and readable traffic without claiming TLS decryption.
TLS Lab Proxy	Metadata-only TLS handshake, SNI, endpoint, and encrypted-flow context. It does not install a CA or impersonate certificates.
Protocol Fuzzer	Opens the preview-first Packet Forge for small, manually reviewed mutations; no unattended fuzz campaign.
Spoofing Lab	Opens the target-scoped DNS response-spoofing rule engine.
Honeypot Mode	Runs metadata-only decoys on TCP 8022, 8080, and 8443 without collecting credentials or request payloads.

ARP Blackout

NetScope sends forged ARP replies to both the selected device and its default gateway. The target is told that NetScope is the gateway, while the gateway is told that NetScope is the target. In disconnect mode, the traffic is deliberately misdirected instead of forwarded.

• The local host and default gateway cannot be selected as targets.
• Active sessions show worker state, sent packets, failures, and errors.
• Reconnect and shutdown workflows stop poisoning and send corrective ARP frames.
• Packet transmission is not remote confirmation; always verify that connectivity was restored.

Ghost Gateway and Wiretap View

Ghost Gateway performs the same bidirectional poisoning but attempts to enable IPv4 forwarding. This keeps the target online while routing its traffic through the NetScope host for inspection.

Wiretap View can classify ARP, IPv4, IPv6, ICMP, TCP, UDP, DNS, multicast, and local-discovery traffic. It extracts DNS activity and TLS SNI, correlates recent DNS answers with IP traffic, identifies common services, and reports direction, endpoint, protocol, category, traffic volume, and encryption context.

NetScope does not decrypt TLS, QUIC, DNS-over-TLS, or DNS-over-HTTPS. A forwarding failure, missing driver, crash, or incomplete ARP restoration can interrupt the target.

Transparent interception starts only after host IPv4 forwarding is confirmed. NetScope records the interface's original forwarding state and restores that exact state after the final interception using it stops. Capture and DNS features hold separate ownership claims, so stopping one shared feature does not silently stop another; stopping the final owner sends corrective ARP frames and restores forwarding.

DNS Hijack

DNS Hijack watches conventional DNS queries from a selected device and sends spoofed responses for enabled rules.

• Match a domain and its subdomains.
• Redirect to a chosen IPv4 address.
• Add, remove, enable, disable, and load preset rules.
• Track passed and redirected queries.
• Automatically request ARP interception when required.

Cached DNS, encrypted DNS, private resolvers, HTTPS, and certificate validation can prevent or expose the redirect. Stopping the tool does not clear answers already cached by the target.

Stopping DNS Hijack also releases the ARP interception claim it acquired. If another feature is inspecting the same target, that shared session remains active until its own control is stopped.

Packet Forge

Packet Forge previews a packet before sending it, including its layers, fields, size, summary, and hex dump. It supports ARP, ICMP, TCP, and UDP with configurable addresses, ports, flags, sequence values, TTL, and payloads.

Presets include gateway ping, ARP who-has, TCP SYN probes, UDP datagrams, and gratuitous ARP. Previewing is harmless; pressing Send puts the packet on the real network.

Network intelligence

The active tools sit on top of a complete monitoring and analysis layer:

• Live overview: gateway/internet latency, jitter, packet loss, throughput, peaks, provider details, and quality score.
• Performance monitoring: 5 Hz interface sampling with stable two-second display buckets and quiet-versus-loaded latency context.
• Device discovery: neighbor table, ARP, ICMP, DHCP leases, SSDP/UPnP, reverse DNS, service probes, router APIs, and SNMP.
• Device identity: IP, MAC, hostname, vendor, model, OS, type, confidence, risk, trust, evidence, and provenance.
• Network map: topology inferred from current discovery evidence.
• Application traffic: local process, PID, destination, rate, totals, activity time, confidence, and attribution evidence.
• Diagnostics: bufferbloat-like latency, weak Wi-Fi, slow DNS, packet loss, and IPv6 availability.
• Security observations: new devices, duplicate MAC evidence, untrusted devices, elevated risk, and scan alerts.
• Local intelligence: deterministic answers grounded in current measurements rather than a cloud chatbot.
• Reports: JSON evidence, anonymized Markdown diagnostics, and HTML device-inspection reports.

Measurements that are unavailable remain unavailable; NetScope does not fill the interface with simulated telemetry.

Privacy and local data

• Privacy mode masks sensitive identifiers in the interface.
• Anonymize exports independently masks IP and MAC addresses in JSON, Markdown, and HTML reports. PCAP files intentionally remain raw packet captures and can contain sensitive data.
• Measurement history is stored in the operating system's per-user application-data location, retained for 30 days, and pruned automatically.
• Delete all local data uses an explicit confirmation dialog and deletes stored metric/audit records plus in-memory chart history.
• Provider details require a public metadata lookup. At startup and approximately every 30 minutes, NetScope tries https://ipinfo.io/json, then https://ipapi.co/json/ if needed. It sends an ordinary HTTPS request whose source address is necessarily visible to that service; it does not send credentials or local-device inventory. This lookup is separate from UI privacy masking.

Discovery limits

Active discovery is explicit and restricted to private IPv4 networks containing at most 1,024 addresses. It uses bounded ARP, ICMP, SSDP/UPnP, reverse-DNS, and common-service probes. Discovery can wake devices, populate caches, and appear in security logs, but it does not exploit discovered services.

Device identity is evidence-based. Randomized or locally administered MAC addresses remain unknown unless another source supplies reliable identity information.

Router support

Router adapters are optional and capability-gated:

• Generic gateway: read-only fallback.
• OpenWrt: authenticated ubus JSON-RPC status and DHCP inventory.
• SNMPv2c: read-only router health and IP-MIB neighbor records.
• Huawei H155-381 / compatible Huawei CPE: authenticated status, device inventory, and capability-gated MAC-filter blocking through the router API.

Adapter foundations also exist for UniFi, pfSense, MikroTik, and UPnP, but they are not complete production integrations. Credentials are retrieved from the operating-system keyring.

OpenWrt example:

python -m keyring set NetScope:openwrt netscope
$env:NETSCOPE_ROUTER_ADAPTER="openwrt"
$env:NETSCOPE_OPENWRT_URL="https://192.168.1.1"
$env:NETSCOPE_OPENWRT_USERNAME="netscope"
python -m netscope

Terminal interface (Windows and Linux)

NetScope also ships a full terminal frontend backed by the same controller, collectors, settings, safety checks, and recovery paths as the glass desktop interface:

netscope-tui

You can also select the frontend explicitly:

python -m netscope --tui

The terminal interface supports mouse input and complete keyboard operation. Use Tab and Shift+Tab to move focus, Enter to activate a selected tab or action, [ and ] to change workspaces, Ctrl+P for the command deck, Ctrl+R for safe discovery, Ctrl+Space to pause or resume collection, and ? for the in-app interaction and safety guide. Wide terminals use the full navigation rail; narrower terminals automatically switch to a scrollable tab strip and stacked cards without hiding features.

On Linux, install the package in a virtual environment and run netscope-tui. Packet capture, ARP interception, forwarding, and other privileged operations still require the platform permissions and capture drivers documented above.

SNMP example:

python -m keyring set NetScope:snmp community
$env:NETSCOPE_ROUTER_ADAPTER="snmp"
$env:NETSCOPE_SNMP_HOST="192.168.1.1"
$env:NETSCOPE_SNMP_CREDENTIAL="community"
python -m netscope

Huawei H155-381 example:

python -m keyring set NetScope:h155381 admin
$env:NETSCOPE_ROUTER_ADAPTER="h155381"
$env:NETSCOPE_H155381_URL="http://192.168.8.1"
$env:NETSCOPE_H155381_USERNAME="admin"
python -m netscope

Set NETSCOPE_H155381_VERIFY_TLS=1 only when the HTTPS endpoint has a certificate trusted by the host.

Requirements

• Python 3.12 or newer.
• Administrator/root privileges for most active packet operations.
• Scapy and the dependencies declared in pyproject.toml.
• On Windows, Npcap in WinPcap-compatible mode is recommended.
• An interface connected to the network being observed or tested.
• Explicit authorization for the network and devices in scope.

End-user guide: install, launch, and operate NetScope

This guide covers the normal journey from installing NetScope to observing a network, using each workspace, exporting results, and safely ending an active lab session. The desktop and terminal frontends use the same controller and backend. A setting or operation performed in either frontend has the same meaning and safety checks.

Important

Start with observation, discovery, diagnostics, and reports. Use ARP interception, DNS redirection, packet injection, or disconnect controls only in an isolated lab or on a network and devices you are explicitly authorized to test. Keep the stop, reconnect, and recovery controls visible throughout an active test.

1. Install on Windows

1. Connect the computer to the authorized network you want to observe.
2. Install Npcap in WinPcap-compatible mode if packet capture and active packet features are required. Restart Windows if its installer requests it.
3. Download NetScope-0.4.1-Windows-x64-Setup.exe from a trusted NetScope release. Keep about 400 MB free during setup for the download, temporary installation data, the installed application, and Windows' installer cache.
4. Double-click Setup. Review and accept the license, then select Choose location if you want another disk or folder. Type or browse to the full destination (for example, D:\Apps\NetScope), return to the welcome page, and select Install. The progress page identifies the package and current action while Windows copies the complete private Python/Qt runtime.
5. When setup reports success, select Launch, or open the Start Menu. Setup creates two shortcuts:
   • NetScope opens the glass desktop interface.
   • NetScope Terminal opens the terminal interface.
6. For ordinary viewing, open either shortcut normally. For packet capture, ARP, DNS, forwarding, or injection features, right-click the shortcut and choose Run as administrator.

Current local builds are reported as unsigned unless the release maintainer supplies a code-signing certificate. If Windows displays an unknown-publisher warning, verify the download source and published checksum before deciding whether to run it. Do not override a warning for an untrusted file.

To uninstall NetScope, stop every active lab session, close the application, then remove NetScope from Settings → Apps → Installed apps, or run the same Setup file again and choose Uninstall. Choosing Repair restores missing or damaged program files without requiring a separate runtime. Removing the program does not make previously exported HTML, JSON, Markdown, or PCAP files safe to share; review or delete those separately.

2. Install the terminal application on Linux

The graphical Qt frontend is primarily packaged for Windows. The Textual terminal frontend is cross-platform and can be installed from the repository or a NetScope wheel:

python3 -m venv .venv
source .venv/bin/activate
python -m pip install .
netscope-tui

Alternatively, run python -m netscope --tui. Start without elevated privileges when you only need the available read-only measurements. Packet capture and network-state changes require the appropriate root/capture permissions for the Linux distribution and interface. Do not run active lab features until those permissions and the recovery path have been tested on an isolated network.

3. First launch and first safe scan

1. Launch NetScope or NetScope Terminal.
2. Allow the initial collectors several seconds to identify the active interface, gateway, neighbor table, and live traffic. A value that remains unavailable is not simulated.
3. Confirm that the displayed interface and gateway belong to the authorized network. If they do not, change the operating-system network connection and restart NetScope.
4. Leave Privacy mode enabled while learning the interface or sharing the screen. It masks sensitive identifiers in both frontends.
5. Open Overview and run Safe discovery. Review the confirmation before continuing. The scan is bounded to a detected private IPv4 subnet of at most 1,024 addresses.
6. Open Devices and verify that discovered addresses, source labels, and confidence values make sense. “Unknown” means the available evidence was insufficient; it is not an error and should not be replaced with a guess.
7. Open Diagnostics, select Run diagnostics, and review warnings before attempting any active lab feature.

4. Navigate the desktop and terminal interfaces

In the desktop interface, select a workspace from the left sidebar. Use the small sidebar control to collapse or restore its labels. The custom title bar supports minimize, maximize, restore, double-click maximize/restore, dragging, and edge/corner resizing.

The terminal interface supports both mouse and keyboard operation:

Input	Result
Tab / Shift+Tab	Move focus forward or backward.
Enter or click	Activate the focused tab, row, switch, or button.
[ / ]	Open the previous or next workspace.
1 through 9	Open workspaces 1 through 9.
Ctrl+P	Open the command deck.
Ctrl+R	Run safe discovery.
Ctrl+Space	Pause or resume live collection.
P	Toggle privacy mode.
?	Open the keyboard and safety guide.
Q	Open the safe-quit confirmation.

On wide terminals the workspace rail remains visible. Compact terminals use a scrollable tab strip and stacked cards. Resize the terminal if a table needs more room; no feature is disabled by the compact layout.

5. Workspace-by-workspace usage

Overview

Use Overview as the starting point for every session.

1. Check the network/interface identity and collector status.
2. Read the quality, latency, device, and traffic cards. Let the history build before treating a short spike as a trend.
3. Select Safe discovery to refresh the device inventory, or Run fresh checks/Fresh diagnostics to update diagnostic measurements.
4. Use Pause collection when you need the display to stop updating. Resume it before expecting new measurements.

Devices

1. Select Discover devices and accept the bounded active-discovery prompt.
2. Select a device row. Compare its IP address, MAC address, hostname, vendor, type, confidence, risk, evidence, and collection-source label.
3. Use Inspect selected/Details for the full evidence view.
4. Use Sniff selected only for an authorized endpoint. Stop the capture when the needed observation is complete, then export a report if required.

A device may appear under a different randomized MAC address later. NetScope reports the evidence it has; it does not promise permanent identity tracking.

Network map

1. Run Refresh topology or Active discovery.
2. Read the local host, gateway, and endpoint relationships as an inferred view of current evidence—not a router configuration diagram.
3. Use the source and status labels to distinguish observed, inferred, live, elevated-risk, and unknown information.

Performance

1. Leave collection running long enough to establish an idle baseline.
2. Select Run measurement where available to refresh latency and network checks.
3. Compare ping, jitter, packet loss, loaded latency, and throughput history.
4. Pause collection only when you intentionally want a frozen display.

NetScope does not substitute ordinary interface traffic for a completed speed test. Compare tests under similar Wi-Fi signal, load, and route conditions.

Analytics

1. Keep collection active and generate ordinary traffic from applications on the NetScope host.
2. Review process name, PID, destination, current rate, totals, activity time, attribution confidence, and evidence.
3. Treat unattributed traffic as unknown. The view covers host-visible metadata and does not decrypt encrypted application payloads.

Diagnostics

1. Select Run diagnostics/Re-test for fresh health measurements.
2. Select Safe evidence scan to refresh local interface, gateway, and neighbor evidence without starting interception.
3. Expand a finding to read its confidence, evidence, alternatives, and next action.
4. Select Export evidence for JSON evidence or Export report for an anonymized Markdown diagnostic report.

Most structured exports are written to the operating system's Documents folder under NetScope. Device inspection HTML reports are written to the Desktop when it is available. Always read the completion message for the exact destination.

Security

1. Review risk findings, untrusted-device counts, and evidence-source labels.
2. Run Active discovery when the inventory is stale.
3. In terminal Security, or in the desktop ARP lab scan-detector card, select Start detector/Start Monitoring to watch visible traffic for SYN, XMAS, NULL, FIN, and UDP sweep patterns.
4. Select Stop detector/Stop when monitoring is no longer needed.
5. Use Clear alerts only to clear the displayed scan-alert history; it does not change a remote device or firewall.

No alert means only that NetScope did not observe qualifying traffic on the selected interface. It is not proof that the network is safe.

Router controls

1. Open Router controls and read the adapter and capability status.
2. Configure a supported adapter and store its credential in the operating system keyring using the examples in Router support.
3. Restart NetScope after changing adapter environment variables.
4. Use only controls explicitly reported by the authenticated adapter.

Unavailable controls are intentionally unavailable. Local neighbor evidence does not prove that NetScope can change the router, and the application does not report success for an unsupported operation.

Intelligence

1. Run fresh diagnostics so the answer has current evidence.
2. Select a suggested question or enter a local question such as “Why is latency elevated?”
3. Select Ask locally/Ask NetScope.
4. Read the answer together with its diagnoses, evidence, uncertainty, and recommended next actions.

This is deterministic local guidance based on NetScope measurements, not a cloud chatbot and not a substitute for evidence that was never collected.

ARP lab

Open ARP lab only after safe discovery identifies the correct endpoint. The local host and default gateway cannot be selected as disruptive targets.

Capture traffic for one device

1. Select the authorized device in the target table.
2. Select Sniff/Start sniff and approve the warning. NetScope requests transparent interception and confirms host forwarding before reporting the capture as active.
3. Generate the authorized test traffic and review packet metadata, DNS names, TLS SNI, services, direction, and encryption context.
4. Select Stop sniff. Confirm that capture and interception state stop.
5. Optionally select Export capture HTML or Export capture JSON. Use Clear capture after saving anything that must be retained.

Disconnect and restore one device

1. Select the authorized non-gateway device and keep Reconnect/Restore visible.
2. Select Disconnect, read the target details, and explicitly confirm.
3. Observe the session state rather than assuming sent packets changed the remote endpoint.
4. Select Reconnect/Restore as soon as the test is complete.
5. Verify connectivity from the endpoint itself. A local “restored” status cannot prove that every remote ARP cache accepted the correction.

Create a DNS redirect rule

1. Select the authorized target.
2. Select DNS/Add DNS rule. Enter the domain match and destination IPv4 address, or load and review a preset.
3. Select the rule and use Toggle rule if it is not enabled.
4. Select Start DNS and approve the interception confirmation.
5. Review the DNS log for passed and redirected conventional DNS queries.
6. Select Stop DNS before removing or clearing rules, then verify the target normally resolves names. Cached or encrypted DNS may prevent or outlast a redirect.

Preview and send a custom packet

1. Select Packet Injector/Packet forge.
2. Choose ARP, ICMP, TCP, or UDP and enter the authorized addresses, ports, flags, TTL, sequence data, count, interval, and payload as applicable.
3. Select Preview and review every layer, field, size, summary, and hex dump.
4. Select Send reviewed packet only when the preview exactly matches the intended bounded test, then approve the final confirmation.
5. Review packet history for local send results. A send result is not proof of receipt or acceptance by the target.

Advanced ARP lab

Use the advanced lab when you need a complete, recorded experiment lifecycle:

1. Select Fresh discovery and wait for the target inventory.
2. Review the module descriptions and risks in the module table.
3. Select one module and choose Select module.
4. Select an authorized target where the module requires one, then choose Select target.
5. Enable Authorization confirmation only after verifying the scope.
6. Select Launch, review the prepared module, target, risk, and recovery plan, then confirm.
7. Observe the workflow and timeline. Keep Stop & restore reachable.
8. Select Stop & restore when the observation is complete or immediately if connectivity changes unexpectedly.
9. Verify the endpoint manually, mark the manual recovery check in the desktop UI where shown, and select Verify recovery.
10. Export a PCAP when the selected module captured packets, export the Markdown report after recovery is verified, then select New experiment or Reset session.

The ten module profiles and their limits are listed in Advanced ARP lab. Observation-only or metadata-only modules do not gain extra capabilities merely because they run from this page.

Settings

• Privacy mode masks sensitive identifiers in both frontends. It changes presentation, not what the collectors can observe.
• Anonymize exports masks IP and MAC addresses in JSON, Markdown, and HTML output. PCAP remains raw and may contain sensitive packet data.
• Reduced motion disables nonessential transitions and chart animation.
• Run fresh diagnostics refreshes the measurement context.
• Delete all local data/Clear local data permanently removes stored metric and audit history after confirmation. It does not delete files that were exported elsewhere.

6. End a session safely

Before closing NetScope after any active lab work:

1. Stop DNS interception.
2. Stop every device capture.
3. Reconnect/restore every disconnected target.
4. Select Stop & restore in the advanced lab.
5. Run Verify recovery and manually confirm endpoint connectivity.
6. Export any required evidence or report.
7. Quit normally. The shutdown path stops local workers, sends corrective ARP frames for owned sessions, and restores the host forwarding state recorded before NetScope changed it.

Do not assume that force-ending the process, losing power, or crashing the host completed remote recovery. After an abnormal stop, reopen NetScope with the required privileges, use the available stop/reconnect workflow, and verify the affected endpoint and gateway directly.

7. Troubleshooting

Symptom	Checks and resolution
The installed app does not open	Keep the installed bundle intact, launch its shortcut instead of copying NetScope.exe, and check whether endpoint security quarantined a runtime file. Run trusted Setup again and choose Repair if files are missing.
Windows reports an unknown publisher	The build is unsigned. Verify its trusted source and checksum. A public release should be rebuilt with the signing workflow below.
No interface or gateway appears	Confirm the host is connected to an active network, disconnect unused VPN/virtual adapters, resume collection, and restart NetScope.
Few or no devices appear	Run safe discovery as administrator/root, confirm the subnet is private and no larger than 1,024 addresses, and remember that host firewalls and sleeping devices may ignore probes.
Capture or ARP controls are unavailable	Install Npcap in WinPcap-compatible mode on Windows, run NetScope with the required privileges, select a valid non-host/non-gateway target, and confirm its IP and MAC evidence are available.
A capture reports no traffic	Confirm the correct target and interface, generate authorized traffic, check that forwarding/interception is active, and remember that switched networks expose only traffic in the host's path.
DNS redirection does not appear	Check that the rule is enabled and DNS interception is active. Cached DNS, DoH, DoT, private resolvers, HTTPS, and certificate validation can prevent or reveal the redirect.
A router control remains disabled	Configure and authenticate a supported adapter. The generic gateway and incomplete adapters remain read-only by design.
An export seems to reveal identifiers	Enable Anonymize exports before exporting. Never assume PCAP is anonymized.
The terminal layout is cramped	Enlarge the terminal; NetScope will switch automatically between compact and wide navigation. Use Tab, [/], or the mouse to reach controls.
A target is still offline	Stop every feature that owns interception, use reconnect/restore, wait for corrective ARP frames, then renew connectivity or clear ARP state on the authorized endpoint and verify the gateway.

Developer install and run

python -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -e ".[dev]"
python -m netscope

For a normal non-editable installation from the project directory:

python -m pip install .
python -m netscope

Build the Windows installer

For a normal Windows release, build the single installer:

.\scripts\build_installer.ps1

The primary result is dist\installer\NetScope-0.4.1-Windows-x64-Setup.exe. It provides the custom glassy setup flow, license acceptance, a disk/folder browser, detailed progress, repair, uninstall, and launch actions. The secondary dist\installer\NetScope-0.4.1-Windows-x64.msi is retained for enterprise deployment tools. End users only need Setup; they do not install both files.

Setup places NetScope and its private Python/Qt runtime in the chosen folder. It creates NetScope and NetScope Terminal shortcuts in the Start Menu and on the desktop. Both launch the same packaged executable and backend; the terminal shortcut selects the TUI with --tui. Do not copy NetScope.exe away from its runtime folder.

The installer build requires the .NET SDK. Its pinned WiX Toolset is restored automatically. To rebuild only the unpackaged application during development:

.\scripts\build_windows.ps1

That development build is an application bundle at dist\NetScope; keep the folder intact and launch dist\NetScope\NetScope.exe. Run the bundled terminal frontend with either of these commands:

.\dist\NetScope\NetScope.exe --tui
.\dist\NetScope\NetScope-Terminal.cmd

Signed Windows releases

Windows trusts a release only when it is signed with a valid code-signing certificate. After importing your certificate, list its thumbprint and create a release that requires both the application and installer signatures:

Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert
.\scripts\build_installer.ps1 `
    -CertificateThumbprint "YOUR_CERTIFICATE_THUMBPRINT" `
    -RequireSignature

The signing script uses SHA-256, applies an RFC 3161 timestamp, and verifies the resulting Authenticode signature. Without a certificate thumbprint, local builds still work but are deliberately reported as unsigned.

Run the tests:

python -m pytest

Run a headless launch check:

$env:QT_QPA_PLATFORM="offscreen"
$env:QT_QUICK_BACKEND="software"
$env:NETSCOPE_AUTOQUIT_MS="1500"
python -m netscope

Run a terminal frontend smoke check:

$env:NETSCOPE_AUTOQUIT_MS="1500"
python -m netscope --tui

Package

Build and smoke-test a wheel:

python -m pip install build
python -m build --wheel
python -m pip install --force-reinstall .\dist\netscope-0.4.1-py3-none-any.whl
$env:QT_QPA_PLATFORM="offscreen"
$env:QT_QUICK_BACKEND="software"
$env:NETSCOPE_AUTOQUIT_MS="1500"
python -m netscope

Test active operations in an isolated environment before distribution. Unit tests cannot prove that a remote device accepted spoofed ARP state, that host forwarding works on every system, or that corrective packets restored every endpoint.

License

NetScope is open-source software licensed under the GNU General Public License version 2 only (GPL-2.0-only). The packaged application includes components under compatible open-source terms; see THIRD_PARTY_NOTICES.md.

Copyright (C) 2026 NetScope contributors.

Final warning

NetScope gives an operator the technical ability to observe and manipulate devices on a connected local network. Technical ability is not legal permission. You are responsible for authorization, scope, monitoring, cleanup, and recovery.