v2.0 · Now with AI Analysis

Network Security,
at a Glance.

Host discovery, port scan, CVE prioritization by real-world exploitation, AI-powered recommendations and active pentesting — in a single standalone Windows APP. No cloud, all data local.

5,000+ nuclei templates
KEV + EPSS prioritization
0 required dependencies
LANsentry
LANsentry network scan results with device type, CVE and risk columns
Features

Everything for a Network Security Assessment

From device discovery to AI-powered remediation guidance — in a single standalone tool.

🧭

Smart Discovery

ICMP ping, TCP connect fallback for firewalled hosts, plus SSDP/mDNS for UPnP and Bonjour devices with friendly names.

🐍

Native Scanner

Parallel TCP connect scan with banner grabbing and service/version detection — pure Python, no nmap or drivers required.

🔥

CVE Prioritization

CISA KEV flags actively exploited flaws, EPSS estimates exploitation likelihood — going beyond plain CVSS scores.

🤖

AI Analysis NEW

Sends scan summary to Anthropic, OpenAI, OpenRouter or local Ollama — returns executive summary and remediation plan.

📊

Scan History & Diff

Every scan saved. Compare two runs: risk delta, new/removed hosts, changed service versions, new CVEs.

⚔️

Active Pentest

nmap NSE vuln scripts and 5,000+ nuclei templates: SSL/TLS, SMB, default credentials, HTTP headers and more.

🌐

WAN Scan

Detects your public IP with geo, ISP and ASN info and checks open external ports and CVEs from the outside.

🔒

License & Trial NEW

7-day free trial, then Polar.sh license. All data stays local during trial — no registration, no email required.

⚙️

Settings Tab NEW

NVD API key, AI provider config (Anthropic / OpenAI / OpenRouter / Ollama) — stored locally and encrypted at rest via Windows DPAPI.

🎚️

Backend Switch

Auto, force nmap or pure native — your choice per scan. nmap unlocks OS detection and deeper fingerprints.

📤

Reports & Export

HTML, Excel, JSON, CSV and PDF — all locally generated. CSV in UTF-8 BOM for Excel, PDF as a formatted A4 report with severity-coloured host details and full CVE breakdown.

🗺️

Network Topology

Visual map of all discovered hosts with severity coloring, zoom and pan — export as PNG or SVG for reports and documentation.

🌍

Bilingual UI NEW

Full English and German interface — switch anytime in Settings (takes effect after restart).

🏷️

Device Fingerprinting NEW

Classifies every host into a device type — router, server, NAS, printer, IP camera, smart speaker, smart home and more — from vendor, ports and banners.

💡

Wake-on-LAN & Labels NEW

Right-click any host to send a Wake-on-LAN magic packet. Assign persistent custom labels and group tags per MAC address — survive reboots and IP changes.

📈

Dashboard & Network Insights NEW

Dashboard tab shows host-count trends and CVE/critical bars over time. DHCP/ARP lease overview and per-host firewall detection (stealth vs. open) via right-click.

Insights

See What's on Your Network

AI-Powered Security Recommendations

After a scan, send your results to your preferred AI provider — Anthropic Claude, OpenAI GPT-4o, OpenRouter, or a fully local Ollama instance. LANsentry builds a structured prompt from your findings and returns a clear executive summary, prioritized risk list and actionable remediation steps.

  • Choose between Anthropic, OpenAI, OpenRouter or Ollama (local, offline)
  • All data stays local — AI analysis is strictly opt-in
  • Requires your own API key for Anthropic/OpenAI/OpenRouter — or run fully offline with local Ollama (no key needed)
  • Results include executive summary, critical risks and quick wins
  • Pick individual hosts from the result list and analyze just those — no need to send the full scan every time
LANsentry — AI Analysis
Provider: Anthropic | Model: claude-sonnet-4-6
[12:34:56] Analysis complete: ───────────────────────────────────── EXECUTIVE SUMMARY Your network has 8 hosts with 3 critical vulnerabilities. Two devices run actively exploited software (CISA KEV). CRITICAL & HIGH RISKS • 🔥 CVE-2024-6387 CVSS 8.1 — OpenSSH RegreSSHion @ 192.168.1.1 (KEV) • 🔥 CVE-2021-41773 CVSS 9.8 — Apache RCE @ 192.168.1.50 (EPSS 97%) • EOL: Windows Server 2012 @ .20 QUICK WINS Update OpenSSH → ≥9.8p1 (patch ready) Disable Telnet port 23 (replace w/ SSH) Change SNMP community "public" on router ─────────────────────────────────────

Prioritize by Real Danger

Not every high-CVSS CVE is dangerous — and some low-scored ones are actively exploited in the wild. LANsentry enriches every finding with CISA KEV and EPSS data and surfaces the most critical issues first, so you know exactly where to act.

  • 🔥 marker for actively exploited vulnerabilities (CISA KEV)
  • EPSS exploitation probability right in the table and report
  • Offline cache of the KEV catalog — works without internet
CVE Detail
🔥 CVE-2021-41773 CRITICAL
Apache httpd 2.4.49 — Path Traversal & RCE
CVSS
9.8
EPSS
97%
🔥 In CISA KEV — actively exploited

Track Changes Over Time

Compare any scan with a previous run and instantly see what changed — new devices joined the network, new open ports appeared, service versions updated, and new CVEs discovered. A clear risk delta shows whether your security posture improved or worsened.

  • Automatic scan history in a local SQLite database
  • Risk delta: CRITICAL / HIGH / KEV changes at a glance
  • Detects changed service versions and new open ports
History — Comparison
Risk delta: CRITICAL +1 HIGH −2 KEV +1
New Hosts
🆕 192.168.1.77 · iot-cam
New Open Ports
🆕 192.168.1.50:23 (telnet)
Changed Versions
🔄 192.168.1.1:443 · nginx 1.18.0 → 1.25.3
New CVEs
🔥CVE-2024-3273 CRITICAL 9.8 @ 192.168.1.77

Know What's Actually on Your Network

LANsentry doesn't just list open ports — it classifies every host into a device type, combining MAC vendor OUI lookups, open ports, service banners and HTTP/SNMP fingerprints. Routers, NAS boxes, printers, IP cameras, smart speakers and smart-home gadgets are labeled automatically, so you immediately know what you're looking at.

  • 19 device types: routers, servers, NAS, printers, cameras, VoIP phones, UPS and more
  • Dedicated Smart Speaker and Smart Home categories (Sonos, Shelly, Hue, Tasmota, ESPHome…)
  • Color-coded badges right in the scan tree — no manual lookups needed
Device Type Column
LANsentry scan tree with Device Type column showing Router, NAS, Smart Speaker, Smart Home, IP Camera and more
🔒

Your data stays on your machine

LANsentry is designed from the ground up to be a local-first tool. Here is exactly what leaves your machine and what does not.

💾

All scan results are stored in a local SQLite database — never uploaded to any server.

🌐

The only outbound connections: CVE lookups to NVD/CIRCL (standard security DB queries) and Polar.sh license validation — only when you enter a license key.

🤖

AI analysis is strictly opt-in: it sends a structured text summary (no raw packet data) to your chosen AI provider — only when you explicitly click "Analyze". Using Ollama means zero external connections.

📊

No telemetry, no analytics, no crash reporting to external servers. What happens on your network stays on your network.

🔐

API keys are encrypted at rest using Windows DPAPI, tied to your Windows user account — not stored as plain text on disk.

FAQ

Frequently Asked Questions

What can LANsentry do?
Discover network devices, scan open ports, identify running software versions, look up known CVEs, prioritize vulnerabilities by real-world exploitation data, run active pentest checks, visualize the network topology, compare scan runs over time, generate professional reports and use AI to create actionable recommendations.
What can LANsentry NOT do?
LANsentry cannot automatically close or patch security vulnerabilities. It is a read-only analysis tool. It cannot block attacks, monitor live traffic, or replace a professional penetration test or security audit. Unauthorized scanning of networks you do not own or have written permission for is illegal.
Does LANsentry send my data to the cloud?
By default, no. Scan results are stored entirely on your machine. The only outbound connections are CVE database lookups (NVD/CIRCL) and optional license validation. AI analysis is strictly opt-in: only when you enter an API key and click "Analyze" is a text summary sent to your chosen AI provider. Ollama runs 100% locally with no external connection at all.
Does it require nmap?
No. LANsentry has a built-in pure-Python scanner that works without nmap. If nmap is installed, it is used automatically for deeper fingerprinting and OS detection. You can switch the backend manually in the Settings tab.
What is the 7-day trial?
When you first launch LANsentry, a 7-day trial starts automatically — no registration, no email required. After the trial, Network Scan and Pentest require a paid license. All other features (history, topology, reports, AI analysis) continue to work.
Where do I buy a license?
Licenses are available via Polar.sh (linked in the License tab inside the app). Each license covers a configurable number of device activations. Activation requires an internet connection once; subsequent uses work offline.
Is it safe to run on my company network?
LANsentry is a passive read-only scanner by default. Port scanning generates network traffic similar to a standard network ping sweep. For active pentest features, only use them with explicit written authorization from the network owner. Always comply with your organization's security policy.
Does it work on networks with a firewall?
Yes. LANsentry uses TCP connect fallback for hosts that block ICMP ping. A firewall may hide some ports; this is expected behavior and will be reported as "no open ports found" for that host.
Can I wake sleeping devices remotely?
Yes. Right-click any host in the scan results and choose "Wake on LAN". LANsentry sends a standard 802.3 magic packet (6×FF + MAC × 16) over UDP broadcast to port 9. The target device must have Wake-on-LAN enabled in its BIOS/UEFI and be connected via cable.
Can I label or group devices?
Yes. Right-click any host and choose "Edit Label". You can assign a custom name and a group tag, both stored persistently by MAC address in a local SQLite database. Labels survive reboots and IP changes as long as the MAC stays the same.
What export formats are available?
LANsentry can export results as HTML, Excel (.xlsx), JSON, CSV, and PDF. CSV uses UTF-8 BOM encoding (opens natively in Excel) with one row per host-port-CVE combination. PDF is a formatted A4 report with a summary table, severity-coloured host details, and a full CVE breakdown. All formats are generated locally — no internet connection required.
Can LANsentry scan automatically on a schedule?
Yes. Enable "Scheduled Scans" in the Settings tab and set the interval (5 minutes to 24 hours). A background timer triggers a new scan automatically at the chosen interval. If new or missing devices are detected compared to the previous scan, a Windows tray notification appears immediately.
Does LANsentry support IPv6?
Yes. Enter an IPv6 network prefix (e.g. fd00::/64) in the network field and LANsentry will discover IPv6 hosts via ICMPv6 ping and NDP neighbor scanning. Port scanning and CVE lookups work identically for IPv6 targets.
Does LANsentry read SNMP interface data?
Yes. For hosts with SNMP port 161 open, LANsentry automatically walks the ifTable (RFC 1213) to collect interface names, operational status (up/down), link speed, and traffic counters (in/out octets and error counts). The data appears as expandable child nodes under each host in the scan tree. No external SNMP library is needed — the implementation uses raw UDP sockets.
Does LANsentry have a security dashboard?
Yes. The Dashboard tab shows time-series charts per network: host count trend and CVE severity bars (critical, high, other) over the last 30 scans. Summary cards display total scans, average host count, total CVEs and total critical findings for the selected network.
Can I export the network topology as an image?
Yes. In the Topology tab, click "Export PNG" or "Export SVG" to save the current topology view as an image file — useful for documentation, network diagrams and audit reports.
Can LANsentry show DHCP and ARP information?
Yes. Click "DHCP / ARP Info" in the scan tab to view the local ARP cache (IP → MAC mapping) and all DHCP leases currently held by the machine's network adapters — quickly identify dynamically vs. statically assigned devices.
Can LANsentry detect if a host is protected by a firewall?
Yes. Right-click any host → "Firewall Check". LANsentry probes diagnostic ports and classifies each as open, closed (RST received) or filtered (timeout). Hosts where all non-open ports time out are flagged "stealth"; hosts that RST all non-open ports are "open" (no firewall); mixed results indicate a partial firewall.
Pricing

Start Free, Unlock When Ready

A full-featured trial, no strings attached.

FULL LICENSE
Unlimited
After the trial period
  • Network Scan + Pentest unlocked
  • Per-device activation
  • Works offline after activation
  • Buy and manage via Polar.sh
🛒 Purchase License

Ready to see what's on your network?

Download the Windows app and start your 7-day free trial.