\### What is ProxNet?

ProxNet is a web-based local network discovery tool and lightweight intrusion detection system (IDS) that maps subnet relationships as an interactive force-directed physics graph.



\### Technical Capabilities:

\- \*\*Layer-2 ARP Sweeping:\*\* Crafts and broadcasts raw ARP request packets using Scapy (\`srp\`) to discover all active IP/MAC endpoints on the local subnet.

\- \*\*Passive OS Fingerprinting:\*\* Analyzes the Time-To-Live (TTL) field of ICMP Echo Reply packets. Differentiates host operating systems (TTL <= 64 for Linux/macOS/Android, TTL <= 128 for Windows, TTL >= 255 for network appliances).

\- \*\*OUI Hardware Resolution:\*\* Parses the first 3 octets of discovered MAC addresses to identify device manufacturers (Apple, Samsung, Intel, Raspberry Pi, etc.).

\- \*\*Stealth Half-Open Port Scanning:\*\* Performs TCP SYN scans (\`flags="S"\`) on critical ports (22, 80, 443, 445, 3389, 8080) and sends immediate \`RST\` (\`flags="AR"\`) packets upon receiving a \`SYN-ACK\` to avoid establishing full application sessions.

\- \*\*Heuristic Threat Detection:\*\*

  \- Flags newly connected, unrecognized devices.

  \- Alerts on exposed high-risk management ports (SMB 445, RDP 3389).

  \- Detects ARP Spoofing / IP conflicts indicative of active Man-in-the-Middle attacks.

\- \*\*Dynamic Frontend:\*\* Built with Flask and Flask-SocketIO. Features a dark-themed D3.js force-directed graph where devices dynamically gravitate around the gateway router with color-coded risk levels.



GitHub Repository: [https://github.com/prox0959/ProxNet](https://github.com/prox0959/ProxNet)  

Developer Profile: [https://github.com/prox0959](https://github.com/prox0959)