Self-host LAN Sheriff
v1.0.2Network monitor mapping outbound traffic, flagging threats
- Stars
- 156
- CPU
- ~6% of one core (Raspberry Pi 3 Model B+)
- RAM
- 64 MB (Raspberry Pi 3 Model B+)
- Storage
- 512 MB maximum database size
- Ports
- 2911 (Dashboard and JSON API), 2912 (Paired peers (Dispatch))
ghcr.io/291-group/lan-sheriff
What is LAN Sheriff?
LAN Sheriff is a self-hosted network monitoring tool that watches outbound traffic from devices on your network. It operates in two modes: Deputy Mode reads OS socket tables without special privileges to identify which application made each connection, while Patrol Mode captures packets with elevated access to see all devices at a vantage point and provide DNS visibility. Key features include a live world map showing connections, a DNS lookup stream, an auto-generated network diagram, a device inventory, and a suspicion engine with eight detection rules. Multiple instances can pair to share hourly summaries across machines. Alerts can be sent via webhook, ntfy, Discord, or Slack. The software runs on major desktop and server platforms including Raspberry Pi, and is licensed under AGPL-3.0.
Should you self-host LAN Sheriff?
LAN Sheriff scores 47/100 on selfhost.directory (how scoring works) and ranks #31 of 48 in Network Monitoring. It has 156 GitHub stars.
It shipped 3 stable releases in the past year. The latest, v1.0.2, came out on 19 October 2026. New versions land roughly every 4 weeks.
Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is AGPL-3.0-licensed and written mostly in Go.
Its closest alternative on selfhost.directory is mitmproxy (86/100, 46 448 stars). It scores higher overall, so compare the two before you pick. See LAN Sheriff vs mitmproxy side by side.
Features
- Alerts (webhook, ntfy, Discord, Slack)Configured via CLI flags only, not in dashboard
- Bounded self-pruning database
- CSV/JSON Export
- Device inventory (The Roster)
- DNS feed (Radio Chatter)Requires Patrol Mode or machine acting as resolver
- Live egress map (The Watchtower)
- Multi-language Support
- Network diagram (The Precinct Map)
- No account/cloud/telemetry
- Offline database viewer
- Passive capture (never blocks)
- Peer sharing (The Dispatch)Off by default; manual pairing via code
- Suspicion engine (The Wanted List)
- Two capture modes (Deputy/Patrol)Auto-detected based on privileges
LAN Sheriff README
More in Network Monitoring
LibreSpeedSelf-hosted, open-source HTML5 speed test measuring download, upload, ping and jitter in the browser, with optional telemetry and multiple test points.
mallaSelf-hosted open-source Meshtastic network analyzer capturing MQTT data into SQLite with dashboard, packet browser, map, and network graph.
MeshCore HubSelf-hosted, open-source platform for monitoring and managing MeshCore mesh networks with a web dashboard, REST API, and real-time packet capture via LoRa radios.
meshmonitorA self-hosted web dashboard that unifies three mesh protocols into one interface with live maps, messaging, telemetry, and automation.
meshpingSelf-hosted network monitor pinging multiple targets with histogram visualizations and traceroute-based topology maps.
MeshSenseSelf-hosted, open-source desktop app for monitoring Meshtastic mesh networks via Bluetooth/WiFi with real-time mapping, traceroutes, and messaging.
meshviewSelf-hosted open-source web app monitoring Meshtastic mesh networks via MQTT with interactive map, packet analysis, node stats, traceroute, and reliability reports.
MikroDashSelf-hosted cockpit for MikroTik RouterOS v7 gear: live WebSocket monitoring, RBAC plus OIDC sign-in, alerting, config backups and templates, zero-touch provisioning.
mikrotik-dnsSelf-hosted DNS analytics dashboard collecting MikroTik logs via UDP with real-time React UI, domain/client analysis, and live DNS search.
Mikrotik RouterMikrotik router integration for Home Assistant
mitmproxySelf-hosted open-source HTTPS proxy for intercepting, inspecting, modifying, and replaying HTTP and WebSocket traffic.
MonitorixSelf-hosted, open-source monitoring daemon for Linux and BSD servers that charts system, network, sensor and service statistics in a built-in web interface.
0 comments