Wireless Security & Network Monitoring · Project case study
Network Analyzer v2026.08.21
A Linux terminal toolkit for authorized wireless discovery, passive monitoring, scan analysis, reporting, and explainable anomaly detection using locally learned baselines.
Status · Release
Overview
Authorized wireless visibility through a local, inspectable toolkit.
Network Analyzer is a Linux terminal application for authorized wireless discovery, local monitoring, saved-scan reporting, and investigation of unusual wireless behavior.
The Bash launcher prepares a project-local Python environment and transfers execution to a Python dispatcher. Scans, reports, logs, learned patterns, incidents, and optional local ML models remain on the operator's machine.
Capabilities
Discover, monitor, analyze, record, and investigate.
- Perform passive wireless discovery and write CSV, normalized JSON, and local capture-log artifacts
- Inspect access points, channels, signal observations, security indicators, and local risk summaries
- Compare learned access-point patterns with trusted baselines and record explainable anomaly incidents
- Import saved scans, replay observations, export incidents, and generate portable Markdown reports
- Manage monitor-mode transitions and offer normal-network restoration after workflows finish
- Present live views through tmux or optional graphical terminals
- Maintain a passive, deduplicated access-point history through Dev Automate
Architecture
Python engine architecture behind a minimal Bash launcher.
network_analyzer.sh verifies Python, prepares .venv when required, and execs interactive.py. The Python dispatcher creates one shared NetworkAnalyzerCore instance and routes actions to focused engines.
Runtime information remains local. Discovery creates raw CSV and normalized JSON; analysis creates Markdown; anomaly learning persists snapshots, observations, patterns, trust decisions, and incidents in SQLite.
Operator guide
Begin with passive workflows and explicit authorization.
Install dependencies, confirm the approved assessment scope, run readiness diagnostics, select an adapter, and begin with passive discovery or saved-data analysis.
- Run python3 interactive.py --doctor before live work
- Review config.yaml and local output paths
- Start ./network_analyzer.sh and select the intended adapter
- Use passive discovery or saved JSON analysis before active workflows
- Protect generated telemetry and restore normal adapter mode when finished
Validation
Offline regression checks before live radio testing.
- python3 -m compileall -q .
- python3 -m unittest discover -s tests -v
- bash -n network_analyzer.sh folderstruc.sh
- python3 interactive.py --doctor
Live radio behavior should be tested only in an authorized lab or another expressly approved environment.
Safety
Wireless assessment requires an explicit authorization boundary.
Passive discovery, saved-data analysis, reporting, and anomaly review are the normal starting points. Operations that change adapter state or transmit management traffic can interrupt wireless service and belong only in an isolated lab or another expressly approved environment.
Use Network Analyzer only against wireless environments and devices you own or are explicitly authorized to assess.
Publication note
Static, crawlable case study.
This page contains the substantive project description directly in HTML. The existing GLab project catalogue and JavaScript interface can continue to operate independently.