Technical specifications
Exact requirements, platforms, engines, and behaviour — no guesswork. NetVane is a small, self-contained Windows binary that serves a live dashboard at 127.0.0.1:8787 and opens it in a chromeless app window. Version 1.3.1.
Minimum requirements
NetVane's footprint is deliberately small. It runs comfortably on any current PC — no dependencies and no admin rights. It ships as a per-user installer (NetVane-Setup-1.3.1.exe, recommended — no UAC, adds shortcuts, auto-removes the old version) or a single-file portable build (NetVane-Portable-1.3.1.exe).
| Component | Minimum | Recommended |
|---|---|---|
| Operating system | Windows 10 (64-bit) | Windows 11 (64-bit) |
| CPU | Any modern dual-core | Any current multi-core |
| RAM | Runs in modest memory | ~4 GB free |
| Disk | ~200 MB free | SSD (faster start & DB writes) |
| Browser | A modern browser | A Chromium-family browser (Brave or Chrome preferred; Edge works as a last resort) for the chromeless app window |
| Admin rights | Not required | Not required |
| Network | Connected to the LAN you want to scan | Wired or Wi-Fi on the target LAN |
127.0.0.1:8787 and opens it in a chromeless app window (preferring Brave or Chrome, using Edge as a last resort, and falling back to a normal browser tab only if no Chromium browser is present).Supported platforms
The prebuilt binaries are Windows-only (PyInstaller builds per-OS; there is no cross-compiling). Running from source currently targets Windows too — it uses a few Windows-native APIs, so macOS and Linux aren't supported yet.
| Distribution | Platforms | Requirements |
|---|---|---|
| Prebuilt binary | Windows 10 / 11 (64-bit) | None — self-contained installer or portable build |
| From source | Windows (uses Windows-native APIs; macOS/Linux not supported yet) | Python 3.10+ (3.12 recommended), pip install -r requirements.txt, then python run.py |
Get-AuthenticodeSignature in PowerShell. SmartScreen may still prompt while a new certificate builds reputation, but it names the publisher.Distribution & footprint
| Property | Detail |
|---|---|
| Files | NetVane-Setup-1.3.1.exe (installer) and NetVane-Portable-1.3.1.exe (single-file portable) |
| Size | ~19 MB installer · ~18 MB portable |
| Installer | Per-user installer (recommended — no admin/UAC, adds shortcuts, auto-removes the old version); portable build needs no install |
| Admin rights | Not required |
| Build | PyInstaller onefile |
| On-disk data | A small local SQLite database that grows slowly with scan history |
| Dashboard | Self-served at 127.0.0.1:8787; opens in a chromeless app window automatically |
Dependencies
The binary needs nothing installed. One optional tool improves detection; several things people expect to need are not required.
| Dependency | Status | Purpose |
|---|---|---|
| nmap | Optional | OS fingerprinting and richer version detection when you select the nmap engine. The built-in engine is the default and handles everything on its own. |
| Npcap / WinPcap | Not required | Built-in engine uses unprivileged TCP + ARP — no raw-packet driver. |
| .NET | Not required | — |
| Python | Not required (binary) | Only needed to run from source (3.10+). |
| Admin rights | Not required | Scanning runs unprivileged. |
Technology stack
Offline by default: no external fonts, scripts, CDNs, or telemetry. Fonts are self-hosted; the topology library is vendored. NetVane makes four opt-in requests to netvane.doorvane.com — an app-update check, and CVE-intelligence, device-fingerprint and network-owner database updates — and none of them sends any data about your network. The only other outbound traffic is what you trigger yourself (a change-alert webhook, a support report) or an on-demand check you run (internet speed test, DNS benchmark); Privacy lists every category, and the in-app Local-only ledger records each one.
| Layer | Technology |
|---|---|
| Language | Python 3.12 |
| Web framework | FastAPI + uvicorn (ASGI) |
| Database | SQLite (WAL mode) |
| Front end | Vanilla-JS single-page dashboard; a left navigation rail carries the four views with Settings pinned at its foot, and the top bar carries a Scan menu and a ⋯ overflow menu (About, Help & shortcuts, and "Update intelligence" — the over-the-air CVE and device-fingerprint database update) |
| Topology map | vis-network (vendored) |
| Fonts | Inter + JetBrains Mono, self-hosted |
| Live updates | Server-Sent Events (SSE) |
| Binary packaging | PyInstaller onefile |
Scan engines
NetVane ships with a pure-Python native engine — the default — and can use nmap when you explicitly select it. A header pill marks the nmap engine while it is active; the built-in default runs without one.
| Engine | Needs installing? | Capabilities |
|---|---|---|
| Built-in (native) | No | TCP-connect port scan, reads the ARP table for MAC → vendor, reverse-DNS for names, banner grabs, TCP-connect latency (RTT). No raw packets, no admin, no driver. |
| nmap | Optional | Adds OS fingerprinting and richer version detection when selected as the engine. |
The engine setting lives under Settings → Advanced → Scan engine (turn Advanced mode on in Settings first), or as scan_engine = auto | native | nmap — auto (the default) and native both use the built-in engine; nmap runs only when nmap is selected.
Scan profiles & ports
In the app this control is labelled Scan depth — the profiles below are its options.
Five profiles, from a quick liveness sweep to a deep one-off audit. None exploit or alter a device — they observe, and after a scan run non-destructive active checks to confirm which exposures are real.
| Profile | Ports | Detection | Relative speed |
|---|---|---|---|
| Discovery | No port scan — live hosts only | Host presence | Fastest |
| Quick | ~Top 100 | Light service detection | Seconds per host |
| Standard | Top 1000 | Service versions + OS guess | Recommended everyday balance |
| Thorough | All 65,535 | Full version + OS detection | Minutes per host |
| Aggressive | All 65,535 | Full OS/version + safe discovery scripts + traceroute | Slowest — one-off deep audit |
Notable-exposure categories
NetVane flags reachable "notable" services by category, matches detected service versions against a bundled offline CVE database, and validates which exposures are real. Representative ports below.
| Category | Representative ports / services |
|---|---|
| cleartext | Telnet 23, FTP 21 |
| file-share | SMB 445, NetBIOS 139 |
| windows-rpc | 135 |
| remote-desktop | RDP 3389, VNC 5900 |
| database | MySQL, Postgres, MSSQL, Redis, Mongo, Elastic, memcached |
| container | Docker API 2375 |
| ssh | 22 |
| printer | 9100 |
| upnp | 1900, 5000 |
| admin-panel | 8080, 8443 |
Each flagged exposure comes with why-it-matters, risk-of-ignoring, and step-by-step remediation. Where a detected version maps to known CVEs, NetVane surfaces them — matched offline against a bundled NVD + CISA-KEV database (version-range aware, fail-closed to avoid false positives, known-exploited/KEV items first) — and a post-scan active-validation pass confirms which exposures are real versus already-secured.
Network behaviour & protocols
NetVane never exploits or changes other devices. It observes, and after a scan runs non-destructive active probes to confirm which exposures are real — with an optional authenticated depth that tries default/blank credentials for authorized red-team testing only.
| Protocol / method | Used for |
|---|---|
| TCP connect | Port scanning and banner grabs (unprivileged, no raw packets) |
| ARP | Reading the ARP table for MAC → vendor mapping |
| Reverse-DNS (DNS-PTR) | Resolving device names |
| ICMP / host discovery | Finding live hosts (via the active engine) |
| mDNS | Deep identify — learn a device's name |
| NetBIOS | Deep identify — learn a device's name |
| SSDP / UPnP | Automatic device identification — a multicast SSDP query plus an HTTP fetch of each responder's UPnP description (model, maker, type). LAN-only, and pinned to the device that answered. On by default; can be turned off for a purely passive scan. |
| DHCP discovery | Opt-in rogue-DHCP-server check — one broadcast DHCP DISCOVER to list every server that answers. Read-only: it never accepts or takes a lease. |
| UPnP IGD (SOAP) | Opt-in internet-exposure report — asks your router's UPnP gateway which ports it forwards from the internet, plus your public IP. Talks only to your router; never out to the internet. |
| Wake-on-LAN | User-initiated only — a UDP "magic packet" broadcast to wake a specific sleeping device you choose. |
| SNMP v2c | Opt-in, off by default — reads managed switches' BRIDGE-MIB forwarding tables / LLDP to place devices on the Map. Read-only; nothing leaves your network. |
netvane.doorvane.com update checks (below), all of this traffic stays on your local network — NetVane never launches exploits or alters the devices it scans.Data & storage
| Item | Detail |
|---|---|
| Store | A single local SQLite file, netvane.db, on your machine |
| Contents | Scans, devices, observations, and events |
| Growth | A few MB that grows slowly with scan history |
| History kept | Scans, observations and events: everything from the last 180 days, plus your 120 most recent scans whatever their age — a record ages out only when it is both. Both figures are adjustable (7–3650 days, 30–100,000 scans); lowering them never deletes history already recorded. Devices, labels, notes, accepted risks and settings are never removed. Shorter live windows: router-response samples 7 days, data-volume samples 14 days, speed tests last 50. |
| Exports | CSV inventory export; self-contained printable HTML report (Print → Save as PDF); full backup/restore bundle (history + settings) |
Privacy & security posture
Local by design: no telemetry, no analytics. Only two kinds of outbound traffic carry any data about your network, and both happen solely because you act: the optional, user-configured change-alert webhook, and a support report you send from Report a problem after ticking its consent box (recent logs, redacted of device IPs and MAC addresses). Separately, NetVane can make four opt-in calls to netvane.doorvane.com — an app-update check, and CVE-intelligence, device-fingerprint and network-owner database updates — that ask only whether something newer exists and send nothing about your network.
| Aspect | Posture |
|---|---|
| Telemetry | None |
| External calls | No CDNs, fonts, or scripts loaded from the internet. Four opt-in calls only — app-update check, CVE-intelligence, device-fingerprint and network-owner database updates — none sends data about your network |
| Accounts | None — no sign-up |
| Binding | Listens on 127.0.0.1:8787 |
| Outbound traffic | Only two kinds carry data about your network, both requiring your action: the optional, user-configured change-alert webhook, and a consent-gated support report from Report a problem |
| Binary signing | Authenticode, GRCSAC (Azure Artifact Signing, RFC-3161 timestamped) |
Performance characteristics
| Aspect | Behaviour |
|---|---|
| Cold start | ~10–40s the first time |
| Per-host scan time | Scales with the chosen profile — from seconds (Quick) to minutes (Thorough) |
| Live updates | Results stream to the dashboard via Server-Sent Events as they're found |
Known limitations
- The prebuilt binary is Windows-only. Other platforms must run from source.
- NetVane surfaces known CVEs (version-indicated, matched offline against a bundled NVD + CISA-KEV database) and confirms real exposures with non-destructive active validation — but it is not a remote, authenticated deep-exploit scanner like Nessus. It never logs into hosts or runs exploits.
- Switch-level wiring is not visible to scanning, so the topology reflects what's reachable rather than physical cabling.
- mDNS / NetBIOS identify depends on devices responding and on the local firewall allowing it.