NetPulse
A single-window Windows app that sees every device on your LAN, every outbound connection from your PC, and ties the two together — in real time, with sub-second join / leave detection.
Discovery protocols
5
ICMP · ARP · mDNS · SSDP · NetBIOS
Device categories
28
Phones · TVs · Hubs · NAS · IoT · …
Join / leave latency
~ 2 s
Sub-second on mDNS goodbye
Cloud dependencies
0
Runs entirely on your LAN
Devices
Live LAN inventory- ICMP ping sweep of your subnet plus an ARP table read so every IPv4 neighbour the kernel has seen turns up — even silent devices.
- Passive mDNS listener with active unicast query bursts that elicit fingerprints from idle smart-home devices that haven't re-announced recently.
- SSDP, UPnP, and NetBIOS for routers, smart-TVs, speakers, smart-light bridges, and Windows hosts.
- Vendor / model / serial / firmware / management URL resolved from OUI tables, mDNS TXT keys, SSDP USN, and SSH / HTTP / SNMP banners.
- 28-category device-type inference: phones, tablets, laptops, routers, switches, NAS, printers, smart speakers, cameras, doorbells, vehicles, and more — each with a fitting icon.
- Per-device sidebar with full fingerprint, open ports, services, first / last seen, and a clickable admin URL when the device exposes one.
Connections
Outbound-connection monitor- Per-process aggregation of every TCP and UDP socket, polled
through the kernel
GetExtendedTcpTable/GetExtendedUdpTableAPIs — no ETW, so the IDE and OS can't lock up under load. - Real per-connection bandwidth via TCP_ESTATS interop, plus cumulative SENT / RECEIVED meters with a stacked sparkline of recent activity.
- World map rendered over real terrain map tiles, with each remote endpoint plotted at its GeoIP latitude / longitude and arced back to your machine.
- Sticky viewport, city-label pills, and an offline vector-map fallback when there's no internet or no tile cache yet.
Packets
Live capture & inspection- Live packet view — pick a network adapter, click Start, and watch frames stream to and from your PC in real time, frame by frame.
- Three-pane protocol-analyzer layout: the packet list across the top (time, source, destination, protocol, length, info); a parsed protocol-layer tree on the bottom-left (Ethernet → IP → TCP / UDP → application); and a hex + ASCII view of the raw frame on the bottom-right.
- Built-in decoders for ARP, IPv4, IPv6, TCP, UDP, ICMP / ICMPv6, DNS / mDNS / LLMNR, TLS Client Hello (surfaces the SNI host name), and HTTP request lines — anything else still shows with its full raw bytes.
- Adapter activity at a glance — the adapter picker shows a live inbound rate and a colour-coded dot for each adapter, and marks your default-route adapter, so you pick the right one before you start.
- Auto-follow & bounded capture — new rows scroll into view while you're at the bottom of the list, and the capture is throttled so a busy network never overwhelms the window, with a live captured / displayed / dropped counter.
- Local-only — capture runs only while the Packets tab is open and you've clicked Start. Frames live in memory and are discarded when you stop or close the app; nothing is ever sent anywhere. A one-time packet-capture driver install is required — the rest of NetPulse works without it.
LAN Activity
Devices × Connections, joined- Cross-references the Devices tab with the Connections tab and answers "which local apps are reaching which devices on my LAN?"
- Grouped DataGrid by target device, plus a force-directed graph view with a snapshot export.
- Highlights placeholder rows in amber when a connection's remote IP isn't yet in the scanner's results — swaps to the real device as discovery catches up.
Activity & Notifications
Tray-resident- Minimize to system tray with a custom popup that bypasses Windows 11's silent suppression of shell balloon tips from elevated apps.
- In-window snackbar when the app is visible, tray popup when hidden — both surface device joins and leaves in real time.
- 2-second fast-leave watchdog: mDNS unicast probe → kernel ARP cache
check → active
SendARP. Catches actual departures without false-positively marking sleeping phones offline. - 2-second fast-join: every dynamic ARP entry is pumped through the scanner on each watchdog tick, so silent devices that don't announce mDNS still surface within ~ 2 s of grabbing an IP.
- RFC 6762 §10.1 mDNS goodbye detection — devices that announce their departure get a popup in ~ 500 ms.
- Activity tab — a persistent in-window log of every join / leave event with day grouping and reason tags.
Privacy & Security
Local-only by default- Runs entirely on your machine. No cloud sync, no remote control.
- Self-elevates as Administrator via the app manifest — required for raw ICMP and reading the kernel ARP / connection tables.
- Local SQLite (WAL) persistence under
%LOCALAPPDATA%\NetPulse. Wipe the database file to reset to clean defaults.
Requirements
OS
Windows 10 / 11 · x64
Runtime
.NET 8 (bundled)
Privileges
Administrator (self-elevates)
Optional
GeoIP database; packet capture driver