Skip to content
FeikL2002Public

About

Browser network console with a local Mac collector and clearly labeled demo data.

Topics

Resources

Stars

0 stars

Watchers

0 watching

Forks

Latest commit

 

History

2 Commits

Folders and files

NameName
Last commit message
Last commit date
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

GHOSTWIRE

A cyber operations dashboard and local observation toolkit by Lewis Joseph Feik / AmericanSites. It combines topology views, device-evidence panels, packet-analysis workbenches and a separately authenticated local collector.

Components

Component Purpose
Original console Visual command deck, topology, status cards and local analysis tools
Monitoring workspace Source-labeled device observations, host counters, socket metadata and bounded history
House Map Manual device placement and evidence-aware links; visual position is not location tracking
Local collector Loopback-only Node.js service for explicitly authorized discovery and host observations
Capture workbenches Bounded, explicitly started capture/import and analysis workflows with optional external tools
Demo Clearly labeled synthetic examples, separate from live observations

Preview the interface

The dist/ directory is the actual static application source in this snapshot and is intentionally committed.

With Python 3 installed:

python3 -m http.server 8767 --bind 127.0.0.1 --directory dist

Open http://127.0.0.1:8767/demo/ for synthetic demonstration data. The main console is at /, and the advanced workspace is at /monitor/. Stop the preview with Control-C.

Optional local collector

Requirements: Node.js 22 or newer. Host observations primarily target macOS. The core source has no npm dependencies.

node local-backend/server.mjs

Open http://127.0.0.1:3212/ and review setup before connecting a dashboard. The service binds to loopback and creates a private bearer-token configuration in the user's Application Support directory. Starting the listener alone does not start discovery. Explicit connection and scan actions activate their documented collection flows.

The permitted local preview origin is http://127.0.0.1:8767. The source also contains an example hosted dashboard origin in local-backend/server.mjs; hosting a separate copy requires reviewing exact-origin configuration, without weakening browser protections.

TShark/Wireshark, packet-capture, router and attached-phone integrations have separate availability and authorization requirements. Installing this repository does not install a service, scan devices, log in to a router or start packet capture.

Evidence boundaries

  • Mac socket metadata describes this Mac, not every device on the same Wi-Fi.
  • Router client lists, access-point observations and packet visibility are distinct sources.
  • Missing names, models, counters and fields remain unknown. Labels do not prove identity or traffic ownership.
  • Demo data is synthetic. Source timestamps are observation times, not inferred connection start/end times.
  • Topology and House Map placement are visualizations, not measured building locations.
  • Observing an address or port does not reveal encrypted application contents.

Documentation and checks

npm test

Tests use local fixtures and controlled services. They do not establish a live router, phone, switch mirror or household capture result.

Publication status

This sanitized snapshot excludes developer hosting metadata, real snapshots, private bridge settings, credentials, captures, recordings, logs and generated archives. Historical documentation does not establish current behavior on another machine.

No open-source license has been selected for this snapshot. External tools retain their own licenses.

About

Browser network console with a local Mac collector and clearly labeled demo data.

Topics

Resources

Stars

0 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages