Most small offices cannot answer that. Cameras, printers, phones and a few things nobody remembers adding all share the same network as your accounting files.
NetMon answers it, and keeps answering it every minute.
Your switch sends a copy of its traffic to a small mini PC. The box only listens, so it cannot slow your network down.
Nothing is installed on your computers, and nothing needs an agent or a password from them.
NetMon builds a list of everything it sees, with the maker looked up from its network address, and checks each one about every minute.
You mark what you recognize. Anything new is flagged until you do. Mark critical equipment as core and you are alerted on the first missed check.
| Device | Address | Maker | Status |
|---|---|---|---|
| Office router | 192.168.1.1 | TP-Link | Core |
| File server | 192.168.1.5 | Dell | Core |
| FRONTDESK-PC | 192.168.1.21 | HP | Known |
| Dock camera 2 | 192.168.2.12 | Hikvision | Known |
| Unrecognized | 192.168.4.63 | Espressif | Unknown Mark known |
NetMon records connections and DNS lookups, then looks for patterns that matter: a first-time destination, a very large upload at 2 a.m., or a device checking in on a fixed timer, which is how malware often behaves.
It also compares destinations against public threat lists.
| Device | Destination | Sent | Flag |
|---|---|---|---|
| FRONTDESK-PC | outlook.office365.com | 12 MB | |
| File server | 203.0.113.77 | 4.2 GB | Large transfer, new destination |
| Unrecognized | 198.51.100.9 | 2 KB | Beaconing, every 60s |
A morning summary lands in your inbox, and critical alerts email you as they happen.
You choose the thresholds, so it only interrupts you for things you care about.
1 critical, 2 warnings overnight.
File server: large transfer
Put any spare screen on the wall. It rotates through health, subnets, core devices, traffic and alerts, with big type you can read from across the room.
When something critical happens, the screen jumps to the alert and flashes its border. If data stops arriving, it says STALE instead of looking fine.
It is read-only, needs no login on the screen, and opens only from inside your network with a private link.
Type a question. The answer comes from your own data, as a table you can read.
The query runs through a read-only database account that can see five tables and change nothing. This feature is optional and uses your own Claude API key.
SELECT n.hostname, SUM(f.bytes) AS total FROM egress_flows f JOIN nodes n ON n.ip = f.src_ip WHERE f.ts > NOW() - INTERVAL 7 DAY GROUP BY n.hostname ORDER BY total DESC LIMIT 3
| Device | Sent, 7 days |
|---|---|
| File server | 6.1 GB |
| FRONTDESK-PC | 1.3 GB |
| Dock camera 2 | 0.9 GB |
If a device looks compromised, one click can cut it off from the internet at your firewall for an hour, a day, or until you release it.
Your router, DNS server, firewall and anything marked core are protected and cannot be cut off by mistake.
NetMon runs on a mini PC in your office. Traffic records stay on that machine and age out on a schedule you set. It is not a cloud service and nobody else watches your network.
Set up and trained once, with optional support afterwards.