Description
Do you trust the connected-devices list in your router admin page? A pile of android-xxxx and unknown entries, no way to tell them apart, and no idea how many things are actually online, which one is the smart plug you added last month, and which one you have never seen before. nmap will give you an answer, but it is a screen of text — you still cannot see what hangs off what.
L0p4Map draws it as an interactive topology graph: the gateway on top, routers, access points and switches on a second tier, clients grouped under their parent. Nodes are coloured by role — gateway, router, AP, switch, PC, Apple device, mobile, Raspberry Pi, virtual machine, or unknown. Each subnet gets a dashed box labelled with its CIDR, and links come in three visual types: uplink, backbone and client.
Underneath it is fast ARP discovery with a local IEEE OUI database, then role detection from three angles — TTL, port probing and a raw SNMP sysDescr query. Hostnames are pieced together from reverse DNS, NetBIOS and mDNS. nmap is fully integrated: SYN, UDP, OS detection, service versions and NSE scripts, with an attack-surface view that runs vulners for CVEs, complete with CVSS scores, direct NVD links and CSV export.
Turn on continuous monitoring and it sits passively on ARP and mDNS traffic instead of rescanning the network, alerting the moment a new device shows up. Python 3.11+ with PyQt6, GPL-3.0, running on Linux (Debian/Arch, with an AUR package), Windows 10/11 and macOS.
ARP host discovery: fast ARP scanning with a local IEEE OUI lookup, so vendors resolve without an internet connection.
Topology graph: a hierarchical vis.js graph with the gateway on top, intermediate devices below and clients under their parent; switch between Hierarchical and Force Atlas layouts, see each subnet as a dashed CIDR-labelled box, tell uplink, backbone and client links apart, rename any node by double-clicking, and export the graph as CSV or PNG.
Fingerprinting and role detection: a TTL-based OS hint, probing of topology-relevant ports, a raw SNMP sysDescr query with no external libraries, plus vendor and hostname, combined into gateway, router, AP, switch, PC, Apple, mobile, Raspberry Pi or VM.
Default-credential warnings: passive banner grabbing spots iLO, InfoPrint, XPort, SATO and Zebra services — devices that commonly ship with default credentials — and flags them on the graph for manual verification.
Full nmap integration: SYN scans, UDP, OS detection, service versions and NSE scripts, with HTTP, SMB, FTP, SSH and SSL banner grabbing, and output saved to a .txt file.
Attack surface view: exposed services and open ports per host, CVEs from the vulners, vuln and malware scripts, CVSS scoring, direct NVD links and CSV export.
Traffic analyzer: live packet capture with per-device statistics, protocol colouring, a filter bar, double-click to port-scan a device, and CSV export.
Continuous monitoring and alerts: a lightweight agent listens passively on ARP and mDNS without rescanning, notifies you in real time when an unauthorised device appears, and polls SNMP periodically to keep status fresh.
Range cartography: not limited to your own subnet — scan any IP, CIDR or range, with routed ranges mapped by traceroute so hosts group under their last-hop router.
Everything else: ICMP traceroute with live output, interface selection, topology auto-refresh every 30, 60 or 120 seconds, and a dark PyQt6 interface.
Before you run it: Python 3.11+ and an installed nmap are required, packet capture needs Npcap or libpcap, and both ARP scanning and capture need root or Administrator. The author states in the README that it is for networks you own or have explicit permission to test — unauthorised scanning is illegal.
L0p4Map draws it as an interactive topology graph: the gateway on top, routers, access points and switches on a second tier, clients grouped under their parent. Nodes are coloured by role — gateway, router, AP, switch, PC, Apple device, mobile, Raspberry Pi, virtual machine, or unknown. Each subnet gets a dashed box labelled with its CIDR, and links come in three visual types: uplink, backbone and client.
Underneath it is fast ARP discovery with a local IEEE OUI database, then role detection from three angles — TTL, port probing and a raw SNMP sysDescr query. Hostnames are pieced together from reverse DNS, NetBIOS and mDNS. nmap is fully integrated: SYN, UDP, OS detection, service versions and NSE scripts, with an attack-surface view that runs vulners for CVEs, complete with CVSS scores, direct NVD links and CSV export.
Turn on continuous monitoring and it sits passively on ARP and mDNS traffic instead of rescanning the network, alerting the moment a new device shows up. Python 3.11+ with PyQt6, GPL-3.0, running on Linux (Debian/Arch, with an AUR package), Windows 10/11 and macOS.
Features
ARP host discovery: fast ARP scanning with a local IEEE OUI lookup, so vendors resolve without an internet connection.
Topology graph: a hierarchical vis.js graph with the gateway on top, intermediate devices below and clients under their parent; switch between Hierarchical and Force Atlas layouts, see each subnet as a dashed CIDR-labelled box, tell uplink, backbone and client links apart, rename any node by double-clicking, and export the graph as CSV or PNG.
Fingerprinting and role detection: a TTL-based OS hint, probing of topology-relevant ports, a raw SNMP sysDescr query with no external libraries, plus vendor and hostname, combined into gateway, router, AP, switch, PC, Apple, mobile, Raspberry Pi or VM.
Default-credential warnings: passive banner grabbing spots iLO, InfoPrint, XPort, SATO and Zebra services — devices that commonly ship with default credentials — and flags them on the graph for manual verification.
Full nmap integration: SYN scans, UDP, OS detection, service versions and NSE scripts, with HTTP, SMB, FTP, SSH and SSL banner grabbing, and output saved to a .txt file.
Attack surface view: exposed services and open ports per host, CVEs from the vulners, vuln and malware scripts, CVSS scoring, direct NVD links and CSV export.
Traffic analyzer: live packet capture with per-device statistics, protocol colouring, a filter bar, double-click to port-scan a device, and CSV export.
Continuous monitoring and alerts: a lightweight agent listens passively on ARP and mDNS without rescanning, notifies you in real time when an unauthorised device appears, and polls SNMP periodically to keep status fresh.
Range cartography: not limited to your own subnet — scan any IP, CIDR or range, with routed ranges mapped by traceroute so hosts group under their last-hop router.
Everything else: ICMP traceroute with live output, interface selection, topology auto-refresh every 30, 60 or 120 seconds, and a dark PyQt6 interface.
Before you run it: Python 3.11+ and an installed nmap are required, packet capture needs Npcap or libpcap, and both ARP scanning and capture need root or Administrator. The author states in the README that it is for networks you own or have explicit permission to test — unauthorised scanning is illegal.
