NetWatch — Wi-Fi Network Monitor, Bandwidth Limiter & LAN Device Blocker (Windows)

See every device on your Wi-Fi. Throttle or block any of them — right from a clean desktop app. Built by Shehab Albakr.

NetWatch is a free, open-source Wi-Fi network monitor and LAN control tool for Windows. It scans your local network, identifies every connected device (40,000+ vendor database for brand/manufacturer detection from MAC addresses), shows live per-device upload/download usage, and lets you limit bandwidth per device or block devices while the app runs. Ships as source code and a portable single-file NetWatch.exe.

Keywords: wifi monitor windows, network usage monitor, bandwidth limiter per device, block wifi users, lan scanner, who is on my wifi, arp scanner windows, wifi throttle, parental control wifi, network bandwidth control, python network monitor, pywebview desktop app.

---

✨ Features

Feature	Details
🔍 LAN discovery	ARP scan + ping sweep + ARP-table fallback; finds phones, PCs, TVs, IoT, routers
🏷️ Brand detection (40k vendors)	IEEE OUI registry snapshot (40,269 manufacturers) + friendly brand aliases, virtualization overrides (VMware/VirtualBox/Hyper-V/QEMU), randomized-MAC flagging, NetBIOS + hostname + TTL-based OS/type guessing
📊 Live traffic monitor	Per-device down/up rates (2s samples), totals, live chart, top-talker + utilization health strip
🐢 Per-device bandwidth limit	Cap any client (64 Kbps – 50 Mbps) with slider, presets, or exact value
⛔ Block devices	One-click block with confirm dialog + Undo; enforcement lasts only while NetWatch runs
🌓 Light + dark themes	Quiet enterprise console UI, persisted toggle, cursor-reactive backdrop grid
🖥️ Portable desktop app	Native window (WebView2) + same UI streamed in any browser
🛡️ Hardened	Input validation on every endpoint, graceful degradation without Admin/Npcap

🚀 Quick start (portable, recommended)

1. Download NetWatch.exe from Releases (or build it below).
2. Install Npcap (required for scanning, sniffing, block/limit).
3. Right-click → Run as administrator. Double-click NetWatch.exe.
4. Click SCAN NETWORK. Click Block / Limit… on any row.

First launch takes ~30–60s (self-extract). Startup log: %LOCALAPPDATA%\NetWatch\netwatch.log.

🧑‍💻 Run from source

run-admin.bat        :: creates .venv, installs deps, launches (right-click: Run as administrator)

Manual:

pip install -r requirements.txt
python app.py                 :: web mode  -> http://127.0.0.1:5057
python desktop.py             :: desktop window + browser streaming
python desktop.py --no-gui    :: server only
set NETWATCH_GUI=0            :: same as --no-gui
set NETWATCH_PORT=5058        :: custom port (auto-bumps 5057-5066 if busy)

Requirements: Python 3.11+, Windows 10/11, Npcap, Administrator (for control features).

📖 User guide

Dashboard tour

• KPI strip — ENFORCED (with ring gauge + blocked/limited breakdown) · DEVICES (live/peak) · DOWN·LIVE + UP·LIVE (with session peaks) · OBSERVED total.
• 01 · TRAFFIC — live 2-series chart (solid = down, dashed = up), pause/resume, health strip (NET UTIL, TOP TALKER, ENFORCED).
• 02 · CLIENTS — the device table. Sort by state/name/IP/live/total (default: triage = blocked → limited → new → heaviest). Filter pills, type filter, search (/ focuses, Esc blurs). NEW badges mark fresh joiners.
• Columns — device name (NetBIOS → hostname → brand fallback) · brand/type + OS guess · IP/MAC (click IP to copy, latency + TTL) · live ↓↑ (pulsing LIVE tag when active) · total with segmented meter + last-seen · state badge · control buttons.

Blocking a device

1. Click Block → confirm dialog names the target and consequence → BLOCK DEVICE.
2. A toast offers UNDO (8s). Or click Unblock / Release later.
3. Gateway and your own PC show NOT ENFORCEABLE callouts instead of buttons.

Limiting bandwidth

Click Limit… → dialog shows the device's current down/up/total → set cap via slider, preset (256K/1M/5M/15M), or exact kbps value → APPLY. Toast offers UNDO.

How enforcement works

Host-based ARP spoofing: NetWatch tells the victim "I am the gateway" (bogus MAC) and tells the gateway the victim is elsewhere, black-holing its traffic. Limited mode poisons a duty cycle of each 10s window so average throughput ≈ cap. controller.restore_all() sends corrective ARP on release/exit — devices recover in seconds. Nothing persists after quit.

Brand detection: how 90%+ is achieved

1. 40,269-entry IEEE OUI snapshot (netcore/oui_db.json, built by assets/build_oui.py from oui.txt + nmap extras).
2. Registry-name cleaning — corporate suffix stripping, friendly aliases (Apple, Samsung, Xiaomi…), placeholder filtering.
3. Virtualization overrides — VM OUIs map to hypervisors even when the registry names another owner.
4. Signal fusion — OUI (NIC vendor) + NetBIOS + hostname + TTL-OS + latency → device type guess.
5. Refresh the snapshot anytime: download fresh oui.txt to %TEMP% and run python assets/build_oui.py.

Honest note: OUI identifies the network-chip vendor. A Lenovo laptop may show Intel/Realtek (its Wi-Fi chip) — the hostname/type guess usually still nails it. ODM/module parts (e.g. AcSiP inside a phone) resolve to the module maker.

❓ FAQ & troubleshooting

Problem	Fix
Failed to load Python DLL	You copied only the old .exe — use the single-file dist\NetWatch.exe (nothing else needed)
App window empty / "not found"	Re-download latest release; check %LOCALAPPDATA%\NetWatch\netwatch.log
control: UNAVAILABLE	Run as Administrator + install Npcap (WinPcap-compat mode)
Scan finds nothing	Same Wi-Fi/subnet? VPNs and AP client-isolation break ARP discovery
Block doesn't affect a phone	Randomized MACs, static ARP, or guest isolation — re-scan, try Limit
SmartScreen warning	Normal for unsigned builds → More info → Run anyway
Port busy	App auto-bumps 5057→5066; or set NETWATCH_PORT
Slow first launch	One-file exe self-extracts (~30–60s once)

🔌 API (for scripts & integrations)

• GET /api/info — subnet, gateway, MAC, control status, version
• GET /api/devices · GET /api/stats — devices + live rates + rules
• POST /api/scan · POST /api/reset-stats
• POST /api/device/<ip>/block|unblock|limit {kbps,mac}|unlimit — validated, 400 on bad input

🏗️ Build

build-exe.bat   :: onefile + windowed + icon + version metadata -> dist\NetWatch.exe

assets/: gen_icon.py (tray/exe icon), build_oui.py (vendor DB), version.txt (exe metadata).

👤 Credits

Designed & built by Shehab Albakr. Vendor data: IEEE-SA OUI registry + nmap-mac-prefixes. UI fostered by open design references.

📄 License

MIT — see LICENSE (to be added). Use only on networks you own or administer.