SpecterLAN: Find the Ghosts on Your Network

offline Devices that returned IP address changes Devices that still need review For the Ghost in the Machine theme, unfamiliar or forgotten devices become the "ghosts" on your network. SpecterLAN does not assume an unknown device is dangerous. It shows what changed and lets you identify the device yourself. It also includes Ask the Ghost, where a local AI model explains network changes using evidence collected by SpecterLAN.

Everything runs locally on your device. Watch the SpecterLAN demo The demo shows: A baseline network scan A new device appearing SpecterLAN detecting the change Ask the Ghost explaining the change with local AI A device changing IP while keeping the same identity Another device going offline SpecterLAN also includes Demo Séance, which uses simulated network data so people can test the full experience without exposing their real network. GitHub repository: https://github.com/rishabh-hasija/spectarlan SpecterLAN is open source and released under the MIT License. SpecterLAN is built with: Python Streamlit SQLite Ollama Gemma 3 4B as the default local AI model Pydantic Nmap when available, with a local fallback when it is not Network scanning happens on the user's own device.

Scan history, device names, trust labels, and other information are stored locally in SQLite. For AI analysis, SpecterLAN sends structured evidence only to the locally running Ollama service. The default model is gemma3:4b. SpecterLAN also detects other compatible Ollama models already installed on the device and lets the user select one from a dropdown.

Ask the Ghost does not decide whether a device is malicious. Instead, SpecterLAN creates evidence records, checks the evidence referenced by the model, and removes unsupported AI output. Network information is private. A network scan can contain device names, local addresses, hardware details, and information about devices inside someone's home.

I did not want SpecterLAN to send that information to an external AI API. Using Ollama and an open-weight model means the AI runs on the same device as SpecterLAN. There is: No cloud AI No API key No SpecterLAN account No registration No shared database No network history uploaded to a SpecterLAN server Users can also switch to another compatible local Ollama model. Even without AI, device discovery, tracking, and scan history continue to work.

This open and local approach keeps the user's network data under their control. Devices appear, disappear, return, and sometimes change addresses. SpecterLAN treats those changes like apparitions on your network. A forgotten device might suddenly appear again.

A new device might show up without a recognizable name. Ask the Ghost helps explain what SpecterLAN observed. The Halloween theme is part of the experience, while the findings remain evidence-based. Unknown does not mean malicious.

SpecterLAN uses Gemma 3 4B through Ollama as its default local AI model. Gemma powers Ask the Ghost, which explains changes between saved network scans using structured local evidence. The model runs on the user's own device, so private network information does not need to be sent to a hosted AI provider.