Frequently asked questions

NetVane is a local, private network scanner and security monitor. You run it on your own machine and it serves a live web dashboard at 127.0.0.1:8787 that discovers every device on your network, identifies what each one is, scores your security exposure, and gives you step-by-step fixes. It is built by GRCSAC in collaboration with doorvane, and is currently at version 1.3.1.

It is not a cloud service or a SaaS — there's nothing hosted and no server to sign in to. You download the app, run it yourself, and everything happens locally.

Free is free forever: a single network, no account, no time limit — not a trial and not a crippled version. On top of that, every install gets 14 days with everything unlocked, with no card and nothing to cancel. Pro is $19 and Business is $99 — both one-time and perpetual, never subscriptions. Pro adds the automation: scheduled unattended scanning, alerts to your phone or chat, background mode, multiple networks, longer history, credential checks and one-click fixes. Vulnerability and fingerprint updates are NOT paid — a tool that tells you it is checking for problems should not be checking against a database we stopped updating. See the pricing page for what each edition includes.

The source code is kept private — NetVane is not currently a public open-source project. The app itself is free to download and use.

The prebuilt binary runs on 64-bit Windows 10 and 11 — either the NetVane-Setup installer or the NetVane-Portable build. NetVane currently targets Windows only: building from source uses a few Windows-native APIs, so macOS and Linux aren't supported yet.

No. There is no account, no login, and no sign-up anywhere. You download the app and run it — that's the whole setup. Because nothing is hosted, there's no account for it to belong to.

Yes. NetVane is fully self-contained — it doesn't load web fonts or scripts from the internet, and everything it needs, including the fonts, the topology-map library, and a bundled CVE database (NVD + CISA-KEV), ships inside the app. It scans your local network and needs no internet connection to do its job.

Four features do reach the internet if you use them, and all are opt-in: an app-update check, a CVE-intelligence database update, a device-fingerprint (device-intelligence) update, and a network-owner update. None sends any data about your network — they only ask whether something newer exists.

Nothing about your network ever leaves your machine. There's no cloud, no account, and no telemetry. Only two kinds of outbound traffic carry any data about your network, and both happen solely because you act: the optional, user-configured change-alert webhook — and only if you set one up — and a support report you send yourself from Report a problem (recent logs, redacted of device IPs and MAC addresses). Separately, NetVane can make four opt-in calls to netvane.doorvane.com — an app-update check, and CVE-intelligence, device-fingerprint and network-owner database updates — but none sends any data about your network; they only ask whether something newer is available.

None at all. NetVane collects no telemetry, no usage analytics, and no crash reports, and it never transmits anything about your network without your say-so. Only two kinds of outbound traffic carry network data, and both need you to act: the optional change-alert webhook you configure, and a support report you send yourself from Report a problem (recent logs, redacted of device IPs and MAC addresses). NetVane can also make four opt-in calls to netvane.doorvane.com — an app-update check, and CVE-intelligence, device-fingerprint and network-owner database updates — but those only check whether something newer is available and send no data about your network.

All of it lives in a single local SQLite database file, netvane.db, on your machine. That file holds your device inventory, scan history, security scores, and any notes you've added. Nothing is stored remotely.

A long time, but not forever — a database that only ever grew would eventually become a problem on your disk. Everything from the last 180 days (about six months) is kept, and on top of that your 120 most recent scans, along with the device detail and changes recorded with them, are kept however old they are. A scan is removed only once it is both older than six months and outside those 120, so the more generous of the two always wins: scanning weekly, that's over two years of history; scanning monthly, a decade; scanning several times a day, a full six months. Alerts and notices that don't belong to a scan simply age out after six months.

Your device list, the labels and notes you write, the risks you've accepted and your settings are never removed — only the scan-by-scan detail behind them ages out. A few live charts keep a deliberately short window because that's all they're for: router-response samples cover the last 7 days, data-volume samples the last 14 days, and the speed test keeps your last 50 results.

The 180 days and 120 scans are defaults you can change in Settings → Data & backup. Lowering them never deletes history you already have — each scan keeps the window it was recorded under, so a smaller setting only changes what is kept from then on.

The tidy-up runs on your own machine at the end of a scan, and nothing is sent anywhere. To keep more, take a backup from Settings → Data & backup → Download backup, or copy netvane.db somewhere safe while the app is closed.

Because everything lives in the local netvane.db file, deleting your data is as simple as deleting that file (and the app itself if you're done with it). There's no cloud copy to purge and no account to close — once the local file is gone, so is the data.

It never phones home with anything about your network, and nothing updates silently. NetVane can check netvane.doorvane.com for a newer app version and can fetch an updated CVE-intelligence database and a fresher device-fingerprint table, but all are opt-in and none sends any data about your network — they only ask whether something newer exists. You then choose whether to download and install the update. There's no background auto-updater.

The change-alert webhook is one of only two kinds of outbound traffic that carry any data about your network (the other is a support report you send yourself from Report a problem), and it's entirely opt-in. If you configure a webhook URL, NetVane will POST a notification to it when something changes on your network — a device arriving, a port opening, and so on. If you leave it unset, no network data leaves your machine. You choose the destination, so it goes only where you point it. (Separately, NetVane can make four opt-in calls to netvane.doorvane.com for an app-update check, a CVE-database update, a device-fingerprint update and a network-owner update, but those send no data about your network.)

Yes. NetVane never exploits, alters, or damages other devices. Beyond observing what's reachable, it does non-destructive active validation by default — protocol probes that confirm which exposures are real versus already secured — and an optional authenticated depth that tries default or blank credentials for authorized testing only; even then it never runs exploits or changes device state. The built-in engine uses ordinary unprivileged TCP connections and reads your ARP table; it sends no raw packets and needs no driver. It's the network-equivalent of walking the halls, noting which doors are unlocked and giving them a gentle push to see if they open — never breaking anything.

Scanning networks you own or are authorized to scan is legal and routine — it's exactly what NetVane is for. Scanning networks you have no permission to scan may not be, depending on where you are. Point NetVane only at networks you're authorized to scan, such as your own home or office LAN.

No. No scan profile attacks or alters the devices it finds. NetVane does non-destructive active validation by default — protocol probes that confirm which exposures are real — and offers an optional authenticated depth that tries default or blank credentials for authorized testing only, but it never runs exploits or changes device state. Even the "Aggressive" profile is thorough and intensive, not hostile: deeper detection and safe discovery scripts, never exploitation. NetVane confirms exposures; it doesn't break anything.

Partly, and it's honest about the limits. NetVane surfaces known CVEs by matching each detected service version against a bundled NVD + CISA-KEV database entirely offline — version-range aware, fail-closed to avoid false positives, with known-exploited (KEV) issues surfaced first and the rest ranked by real-world exploit probability (EPSS) so you fix what's actually being attacked. This is version-indicated CVE matching done locally, and each finding shows the version to upgrade to. After a scan it also performs active risk validation: non-destructive protocol probes (by default) that confirm which exposures are real versus already secured, and an optional authenticated depth that tries default or blank credentials for authorized red-team testing only.

What it is not is a remote, authenticated deep-exploit scanner like Nessus — it never logs into hosts or runs exploits — but it does surface known CVEs and confirm real exposures, on top of flagging reachable services like an exposed SMB share, an open RDP port, or a cleartext Telnet service, with why-it-matters and how-to-fix guidance.

For everyday profiles, no meaningfully. Discovery and Quick scans are light and finish in seconds per host. Deeper profiles like Thorough and Aggressive do far more work — all 65,535 ports and full detection — so they take minutes per host and generate more traffic, but they're meant for occasional one-off audits, not constant use. Pick the profile that matches how deep you actually need to go.

NetVane.exe is Authenticode-signed as GRCSAC — check Properties → Digital Signatures. SmartScreen may still prompt while a new certificate builds reputation, and antivirus may warn on first run. A prompt on a recently issued certificate does not indicate a problem with the file — check that it names GRCSAC. If you would rather build it yourself, you can build from source instead.

For the prebuilt binary you need 64-bit Windows 10 or 11. NetVane serves its dashboard at 127.0.0.1:8787 and opens it in a chromeless app window, preferring a Chromium-family browser (Brave or Chrome, with Edge as a last resort) and falling back to a normal browser tab only if no Chromium browser is present. Resource use is modest: it runs fine on any current PC, and disk needs are just the app plus a small SQLite database that grows slowly with your scan history.

No. NetVane needs no administrator rights. The recommended installer, NetVane-Setup-1.3.1.exe, is per-user and triggers no admin or UAC prompt — it adds shortcuts and removes the old version automatically. There's also a portable NetVane-Portable-1.3.1.exe you can just double-click with no install at all. Either way the built-in scan engine works with unprivileged TCP connections and the ARP table, so it never needs elevated permissions or a packet driver.

No — nmap is optional. If nmap is present on your system, NetVane will use it for OS fingerprinting and richer version detection. If it's absent, the built-in engine handles everything on its own. You get a fully working scanner either way.

No. NetVane's built-in engine uses unprivileged TCP connections and the ARP table rather than raw-packet capture, so Npcap and WinPcap are not required. There's no driver to install.

The installer (NetVane-Setup) is about 19 MB and the portable build about 18 MB. Each is a single self-contained file — a PyInstaller onefile build — so there's nothing else to download and no separate runtime, Python, or .NET to fetch.

NetVane ships as prebuilt Windows binaries — the installer or the portable build — and those are the way to run it, since the source code isn't public. It currently targets 64-bit Windows 10 and 11; macOS and Linux aren't supported yet.

You stay in control — there's no silent background auto-updater. NetVane can make an opt-in check against netvane.doorvane.com to tell you when a newer version exists (this sends no data about your network); you then download the latest NetVane-Setup-1.3.1.exe installer, which replaces the old version for you, or grab the portable build, or pull the latest source and re-run. Separately, the overflow menu's Update intelligence fetches an updated CVE database or device-fingerprint table over the air, depending on which tab you pick. Your data stays intact either way because it lives in the separate netvane.db file, not inside the binary.

It depends on the profile and how many hosts are online. Discovery is the fastest — it just finds live hosts with no port scan. Quick and Standard take seconds per host. Thorough and Aggressive scan all 65,535 ports with full detection and take minutes per host. For everyday use, Standard is the recommended balance.

That's set by the profile — the control is labelled Scan depth in the app. Discovery scans no ports; Quick covers roughly the top 100; Standard covers the top 1,000; and Thorough and Aggressive cover all 65,535. Whatever the profile, NetVane pays special attention to "notable" services — cleartext protocols, file shares, remote desktop, databases, and the like — and flags them with fixes.

There are five, all observe-only. Discovery just finds live hosts (fastest, no port scan). Quick checks about the top 100 ports with light service detection. Standard covers the top 1,000 ports plus service versions and an OS guess — the recommended everyday balance. Thorough does all 65,535 ports with full version and OS detection. Aggressive adds safe discovery scripts and traceroute for a one-off deep audit of a device you own; "aggressive" means intensive, not hostile.

For most people a regular Standard scan — say daily or weekly — keeps the inventory, exposures, and security score current and surfaces new or returning devices. You can turn on optional scheduled scans to do this automatically on an interval you choose. Save the deep Thorough or Aggressive profiles for occasional audits of specific devices.

Yes on both counts. By default NetVane scans the local network your machine is on; you can enter several subnets (comma-separated) or narrow to a single subnet or host. If you turn on Advanced mode in Settings and enable Experimental scanning there, a fresh setup also auto-detects every local network your machine is connected to (up to five) and covers a multi-subnet home automatically. Either way, you can re-scan one device on demand with the Verify action to confirm whether an exposure is truly resolved or still open.

Yes. NetVane supports optional recurring scans on an interval you set in hours, with a simple on/off toggle. Combined with change alerts, this lets NetVane keep watch and notify you when something on your network changes without you having to kick off each scan by hand.

The built-in (native) engine is pure Python and needs nothing installed: it does TCP-connect port scanning, reads the ARP table for MAC-to-vendor mapping, does reverse-DNS lookups, grabs banners, and measures TCP-connect latency — no raw packets, no admin, no driver. nmap, if you have it installed, adds OS fingerprinting and richer version detection. You control which is used with the scan_engine setting (auto, native, or nmap), and a header pill shows which is active.

nmap is a powerful command-line scanner; NetVane is a monitor built around it and around its own engine. Rather than leaving you to interpret raw port output, NetVane identifies each device, scores your exposure, explains why a reachable service matters, and gives step-by-step fixes — then tracks how all of that changes over time. In fact NetVane will happily use nmap under the hood for OS fingerprinting if it's installed, so it complements nmap rather than replacing it.

Those tools are great at answering "what's on my network?" NetVane answers that too, but then goes further: it scores your security posture, flags notable exposures by category with why-it-matters and how-to-fix guidance, tracks change over time, and closes the loop with an on-demand re-scan to verify a fix worked. And it does all of this fully locally — no cloud, no account, no telemetry — which isn't true of every alternative.

A router's list usually tells you which devices are connected and little more — often with cryptic names and no sense of what each device is exposing. NetVane infers each device's type and vendor, shows which services are reachable, scores your exposure, and tells you what to fix. It also tracks history and alerts you to new or returning devices, which most router UIs don't do.

It helps you act, not just read. Each exposure comes with a Fix panel showing why it matters, the risk of ignoring it, and the steps to resolve it, plus a button to open the device's own admin page. You can Verify a fix with a one-click re-scan, Accept a risk to consciously triage it out of the score with a dated note, and Acknowledge a new device as expected. It also generates a printable security report led by a ranked, de-duplicated priority action plan.