NETWATCH v0.3.0-alpha.1 — IPv6 NDP, WSD Discovery & Arabic Localization

NETWATCH v0.3.0-alpha.1 — IPv6 NDP, WSD Discovery & Arabic Localization

"Know Every Device on Your LAN. Without the Cloud Watching."
"اعرف كل جهاز على شبكتك المحلية. دون رقابة سحابية."

NETWATCH v0.3.0-alpha.1 introduces native IPv6 Neighbor Discovery (NDP), zero-privilege WS-Discovery (UDP:3702), actionable Device Quick Actions (Web UI, SSH, RDP), Public Network Firewall Safeguards, and a complete Air-Gapped Arabic Localization & RTL Overhaul with native desktop typography.

---

🌟 Key Capabilities & Highlights

1. 🌐 Full Arabic (RTL) Localization & Typography Engine

• Zero-Egress i18n: Air-gapped translation dictionary covering 100% of user interface strings (English / العربية).
• High-Performance Arabic Typography: Bundled @fontsource/cairo and @fontsource/alexandria with tailored font fallbacks, eliminating browser rendering degradation.
• Strict Bidirectional Isolation: Technical networking strings (IPv4, IPv6, MAC, subnets, ping metrics) are strictly isolated with dir="ltr" to prevent reversed formatting.
• TopBar & Sidebar Ergonomics: Fixed RTL dropdown alignment, re-ordered navigation components, and added desktop sidebar collapse/expand toggle (Ctrl+B / button) with persistent state.

2. 🔍 Unprivileged IPv6 Neighbor Discovery (NDP)

• Zero-Elevation IPv6 Discovery: Integrated Windows native GetIpNetTable2 from iphlpapi.dll with fallback to GetIpNetTable, reading IPv6 neighbor cache without administrator rights.
• Cross-Platform Parity: Linux neighbor ingestion via ip -6 neigh show.
• Database Schema Migration v5: Added persistent ipv6 column tracking dual-stack devices with drift history and 1-click address copy.

3. 📡 WS-Discovery Protocol (UDP:3702) & Multi-Cast Probing

• Hardware & Appliance Visibility: Discovers Windows Workstations, Network Printers, and ONVIF IP Cameras over unprivileged multicast SOAP.
• Hardened XML Parser: XXE-immune, memory-capped parser validated by native Go fuzz testing with over 600,000 malformed inputs.
• Zero-Fetch Invariant: Enforces strict air-gap rules—remote URLs inside XML envelopes are never fetched.

4. ⚡ Device Quick Actions & Host Bridge

• Instant Connectivity: Launch device Web UI directly in default browser via safe local host bridge (POST /v1/system/open).
• 1-Click Terminal Presets: Instant clipboard helpers for SSH (ssh <ip>) and Windows Remote Desktop (mstsc /v:<ip>).
• SSRF & Egress Protection: Host bridge strictly validated against IsAllowedUnicastTarget—arbitrary external URLs are permanently blocked.

5. 🛡️ Public Firewall Safeguard & Security Hardening

• Windows Firewall Detection: Active network category detection alerting users if connected to a Public profile where multicast probing is blocked by Windows Defender.
• Zero-Egress rDNS Hardening: Kernel-level check blocking reverse DNS queries to external resolvers.
• Security Advisory Patch: Upgraded github.com/labstack/echo/v4 to v4.15.3 resolving GHSA-vfp3-v2gw-7wfq.

---

📸 Screenshots & Visual Preview

Dashboard & Overview	Network Topology & Nodes	Settings & Engine State

---

📦 Assets & Cryptographic Verification

Asset	Platform / Type	Size	SHA-256 Checksum
netwatch-v0.3.0-alpha.1-windows-amd64.zip	Windows 64-bit Standalone (ZIP)	9.28 MB	3C099BF296D1FF85D8E735E13E004873E4D4AE989FDDE092254588D56E46736E
netwatch.exe	Windows 64-bit Direct Executable	21.17 MB	BD6930F1D41AB29ABF4259CE20A7F1608494A017F313DA4C1F18BC7F461C740E
SHA256SUMS.txt	Checksum Verification Manifest	194 B	Included in release

---

🔒 Verification & Compliance

• Go Test Suite: go test -race ./... passed with 0 data races.
• Frontend Typecheck & Production Build: tsc --noEmit && vite build 100% clean.
• Zero-Egress Invariant Gate: 100% PASS via AST scanner.
• Multi-OS GitHub Actions CI: All Ubuntu & Windows build matrices are 100% GREEN.

Full Changelog: v0.2.0-alpha.1...v0.3.0-alpha.1

NETWATCH v0.2.0-alpha.1 — Multi-Protocol Discovery & Asset Ledger

NETWATCH v0.2.0-alpha.1 — Multi-Protocol Discovery, User Customization & Asset Ledger

"Know Every Device on Your LAN. Without the Cloud Watching."

NETWATCH v0.2.0-alpha.1 marks the completion of Milestone 3 (Settings & Database Management) and Milestone 4 (Multi-Protocol Discovery, Evidence & Identity). This release introduces user-customizable device classifications, RFC 5389 STUN-based external public IP discovery, multi-protocol identification (mDNS, SSDP, NetBIOS, ARP), and a responsive mobile-first UI layout.

---

Key Capabilities & Highlights

1. User-Defined Device Type & Icon Customization:
   • Classify devices as Workstation, Laptop, Mobile, Tablet, Server, Gateway, Printer, Switch, Access Point, NAS, IoT, or Camera with real-time icon updates.
   • Schema migration v4 (custom_type) guarantees user classifications are permanently preserved across background rescans.
2. WAN Public IP Discovery & Network Topology:
   • Pure binary RFC 5389 STUN NAT traversal over UDP, displaying the public IP on the WAN/INTERNET topology node with zero HTTP egress.
3. Multi-Protocol Discovery & Identification Evidence (M4):
   • Directed NetBIOS Name Service (NBNS) queries over UDP 137 with MAC cross-correlation.
   • SSDP / UPnP multicast discovery over 239.255.255.250:1900 with strict Zero-Fetch Location invariant.
   • Multi-pass mDNS / DNS-SD probing over 224.0.0.251:5353 with loop and packet bombing defenses.
   • Identification Evidence drawer displaying observable protocol signals and service records.
4. Randomized MAC Detection & Merging:
   • IEEE 802 LAA private MAC detection with "Private MAC" badges.
   • Interactive Device Merge & Aliasing engine (POST /v1/devices/{id}/merge).
5. Mobile-First Responsive Layout (/tidyfactor-styler):
   • Slide-over drawer navigation and responsive top bar across all viewports while strictly preserving brand identity invariants.
6. Desktop System Integration (M3):
   • Native Windows toast notifications via WinRT.
   • Autostart with --minimized background launch.
   • SQLite WAL compaction, real-time statistics, and retention pruning.

---

Assets & Integrity

Asset	Description	SHA-256 Checksum
netwatch-v0.2.0-alpha.1-windows-amd64.zip	Standalone Windows 64-bit Desktop App	A796C8782B04A64F286A5A109BE30767743DE56846AB2AACFFBF6F33F53E9F89
netwatch.exe	Direct Windows 64-bit Executable	D1EF90BDA2DEA2EFF7E69210CF47D63D268444A050F362F075EBED4D082BD9B5

---

Verification

• go test -race ./...: 100% PASS
• tsc --noEmit && vite build: Clean production build
• Zero-Egress Invariant: Verified by AST analysis (TestZeroEgressInvariant)

Full Changelog: v0.1.0-alpha.1...v0.2.0-alpha.1

NETWATCH v0.1.0-alpha.1 — Local Network Intelligence & Device Inventory

NETWATCH v0.1.0-alpha.1 — Developer Preview

"Know Every Device on Your LAN. Without the Cloud Watching."
Local Network Intelligence & Device Inventory. 100% offline, zero cloud, zero telemetry.

---

🧠 Beyond Ephemeral Scanning: Asset Intelligence

Traditional network scanners (like Advanced IP Scanner or Angry IP Scanner) are momentary utilities: they perform a fire-and-forget sweep, render a transient table, and discard all state when closed. They have no memory, no temporal awareness, and cannot distinguish a brand new intruder from a stable home workstation.

In NETWATCH, scanning is only the sensor (ingestion mechanism). The true product is the Local Asset Ledger & Reconciliation Engine:

Capability	Ephemeral Scanners	NETWATCH (Local Network Intelligence)
Core Question	"What is responding right now?"	"What was here? What changed? Who joined, left, or drifted IP? When?"
State & Memory	Ephemeral (wiped on app exit)	Persistent local SQLite database across reboots
Asset Lifecycle	No concept of first seen / history	Dedicated timeline tracking joins, departures, and IP migrations
Flap Resistance	Single missed ping triggers disconnect	Threshold reconciliation (misses = 2) prevents sleep-mode false alerts
New Device Detection	Undifferentiated list row	Explicit isNew status badge until acknowledged by user
Data Privacy	Cloud uploads / external API calls common	100% Sovereign: Air-gapped IEEE OUI lookup, zero external requests, zero telemetry

---

🚀 Key Capabilities & Architectural Invariants

• ⚡ Super Fast Subnet Discovery: Active, unprivileged parallel ARP and ICMP sweeps across private IPv4 LANs with concurrent TCP fallback.
• 🏷️ Local Hardware Fingerprinting: Local MAC vendor classification via embedded IEEE OUI database (internal/oui/ieee-oui.txt) with zero external network egress.
• ⏱️ Flap-Resistant Reconciliation: Smart status tracking marks devices offline only after two consecutive missed sweeps (misses = 2), preventing false disconnect alerts for sleeping Wi-Fi devices.
• 🔌 Integrated Diagnostics: Native user-mode Ping with latency measurement, TCP port probing, and RFC-compliant Wake-on-LAN (WoL).
• 📜 Historical Network Timeline: Persistent SQLite local ledger tracking joins, leaves, and IP address migrations.
• 🛡️ Triple-Layer Loopback Security: Local API binds exclusively to 127.0.0.1:<random-port> guarded by an ephemeral 192-bit Bearer token, anti-DNS rebinding Host validation, and cross-site Origin isolation.
• ⚙️ Real Settings & Background Auto-Scan: Background auto-scan engine worker executing periodic network sweeps (1m, 5m, 15m, 1h) with dynamic interval reconfiguration.
• 🗄️ Database Inspection & Maintenance: Live SQLite metrics panel, VACUUM defragmentation compaction, and PRAGMA integrity validation.

---

📦 Downloads & Verification

Asset	Platform	Description
netwatch.exe	Windows 10/11 x64	Standalone portable executable (embedded React 19 UI & SQLite engine)

• Architecture: AMD64 (x64)
• License: Dual-licensed under MIT and Apache 2.0