LokiBytes Network Analyzer v1.1.0

New: Packet Analysis tab ("Advanced Traffic Analyzer")

A full deep-packet capture and analysis module, between Connections and Macro Topology:

• Live Capture - disk-backed (SQLite, WAL mode), filterable, virtually-scrolled packet table that doesn't spike RAM or freeze on long captures, plus a Contextual Insights panel that translates the selected packet's TCP flags / ICMP codes into plain English.
• Process Attribution - real-time process/PID attribution per packet, plus passive ARP/mDNS/LLMNR/NetBIOS neighbor discovery.
• Domain resolution (DNS + TLS SNI) - cross-references plaintext DNS responses and the TLS ClientHello's SNI field, so domains still resolve even under DNS-over-HTTPS. Flags restricted/adult-content domains.
• Anomaly Timeline - a live sparkline with statistical-outlier highlighting; click to jump straight to those packets.
• Blast Radius - a hub-and-spoke map of every remote host you've talked to, color-coded by proxy/hosting/restricted-content flags.
• ETA Classification - heuristic categorization of encrypted flows (e.g. "Media Streaming", "Interactive Shell", "Potential Malware Beaconing").
• Remediation - send a TCP RST to drop a connection, or block/unblock a remote IP at the Windows Firewall, with a persistent "Blocked IPs" list that survives the UAC-elevation restart.
• Four capture modes: Host, Gateway, Promiscuous / SPAN, and zero-config ARP Discovery.

Also: the admin-elevation relaunch (used by IP/process blocking throughout the app) now uses pythonw.exe instead of python.exe when running from source, so no console window flashes for the user.

See FEATURES.md and HOWTO.md for full details.

Since the executable isn't code-signed, Windows SmartScreen may show an "Unrecognized app" warning the first time you run it - click More info -> Run anyway. For full functionality (packet capture, firewall blocking), right-click the .exe and choose Run as administrator.

LokiBytes Network Analyzer v1.0.1

Patch release: fixes a visual issue in the Wireless & Diagnostics tab's Signal Tracker.

Fixed

• The Signal Tracker's radar sweep only redrew whenever a new RSSI sample arrived (every ~1.5s for Wi-Fi/poll-based tracking, or irregularly for Bluetooth), so it visually jumped/choppy instead of rotating smoothly. It now animates on its own steady ~20fps timer, independent of when real signal samples arrive.

Added

• A "Stop Tracking" button next to the Target dropdown on the Signal Tracker sub-tab, to halt polling/animation on demand (toggles to "Resume Tracking").

Download

Download LokiBytes Network Analyzer.exe below and run it - no Python install required. Windows SmartScreen may show an "Unrecognized app" warning since it isn't code-signed; click More info -> Run anyway. For full functionality (packet analysis, firewall blocking, Wi-Fi scanning), right-click the exe and Run as administrator.

Full changelog: v1.0.0...v1.0.1

LokiBytes Network Analyzer v1.0.0

First tagged release of LokiBytes Network Analyzer (formerly LokiBytesSecurity).

Download

Download LokiBytes Network Analyzer.exe below and run it - no Python install required. Since it isn't code-signed, Windows SmartScreen may show an "Unrecognized app" warning the first time; click More info -> Run anyway. For full functionality (packet analysis, firewall blocking, Wi-Fi scanning), right-click the exe and Run as administrator.

Highlights

• Real-time connection table mapping every network connection to its owning process, with security flagging, IP investigation/forensic export, and one-click kill/block actions.
• Macro Topology, Traffic Flow, and Security Analytics tabs with live Sankey/flow/topology/protocol visualizations.
• New Wireless & Diagnostics tab: Wi-Fi/Bluetooth discovery, channel-congestion rating, a live spectrum graph, a signal tracker with proximity pulse, a LAN "Who's Connected" sweep / Bluetooth piconet view, and an unbiased speed test.
• New per-IP firewall blocking from the Investigation Log.
• New Settings toggles: minimize to the system tray on close, and run on Windows startup.

See README.md for full setup/usage details.