The hosted dashboard uses an authenticated collector running on the Mac. The collector binds only to 127.0.0.1:3212. The hosted site keeps its existing owner-only access configuration. A private bearer key authorizes collector requests and is held only in dashboard page memory. The local connection page carries the key in a URL fragment, which the dashboard immediately removes from history. Configuration lives outside the repository at ~/Library/Application Support/GHOSTWIRE/discovery/bridge.json with mode 0600.
Start/installation on this Mac:
node local-backend/install-service.mjs install
node local-backend/install-service.mjs statusOpen http://127.0.0.1:3212/ and choose Connect dashboard. The first authorized scan starts discovery and subsequent approximately 30-second refreshes. The dashboard polls authenticated status every five seconds. Service com.ghostwire.discovery starts at user login; the Mac must remain awake. Stop it with node local-backend/install-service.mjs stop. The connection is loopback-only: another computer requires its own supported secure route rather than exposure of this unauthenticated local setup page.
The hosted dashboard was verified live in Chrome on this Mac after allowing its local-device access prompt. Open the local connection page in Chrome and allow local-network/local-device access when prompted. The ChatGPT in-app browser timed out reaching the loopback collector during verification; use Chrome for the verified connection path. No browser security settings need to be disabled.
The collector reads the actual default route and IPv4 configuration. It accepts the Mac's physical en0 or en1 private LAN interface. It refuses public, VPN, loopback, or malformed scopes. Networks larger than /24 are explicitly narrowed to the host's own /24; smaller networks keep their actual bounds. At most 256 addresses are considered, with 16 probe workers. Probes bind to the observed interface and source address. macOS ping deadlines are one second, with a 500 ms reply wait and a 1,500 ms command timeout. Arbitrary scan targets cannot be supplied through the API.
Actual ICMP replies establish reachability. ARP-cache entries are observations, not proof of current reachability or a last packet time. Missing replies produce unconfirmed records, not offline claims. Prior successful records remain marked stale after failures. A scan cannot silently switch to another LAN midway through execution. The first authorized scan also pins the interface, bounded subnet, gateway, and any available passive gateway MAC for that collector instance. Automatic refresh fails closed if that scope changes; authorizing a new LAN requires restarting the collector and explicitly reconnecting.
The collector reports its own host name, OS, and hardware identifier. Neighbors retain unknown names, manufacturers, models, and categories when no supported source supplies them. The UI uses Unidentified device as a generic display label, explicitly marked name not reported. It does not identify phones from IP addresses or presume device ownership.
netstat -ibn supplies cumulative RX/TX bytes and packet counters from the exact interface's link-layer row. IP rows are not summed a second time. Rates use actual counter deltas and elapsed time. First readings, resets, and interface changes have no rate. History contains at most 30 actual observations, with no generated points. Counters include this Mac's application traffic and collector probes; they do not measure every device in the house.
Established TCP metadata comes from netstat -an -p tcp, limited to 60 displayed endpoints with a separate observed total. Encryption, domains, service names, message bodies, and per-connection transfer sizes are not inferred from ports or socket state. No threat alerts are invented.
A read-only TMI adapter identifies the default gateway using its actual local device response. The verified integration is Arcadyan TMO-G4AR firmware 1.00.18. It reads only /TMI/v1/gateway?get=device and, after explicit local administrator sign-in, /TMI/v1/network/telemetry?get=clients. The only router POST is /TMI/v1/auth/login; there are no configuration, reboot, blocking, or reset operations. The API is firmware specific and is not a documented T-Mobile public developer API. The adapter fails closed on a changed LAN, gateway identity, model or unsupported firmware. Redirects, unbounded responses and arbitrary endpoint requests are rejected.
Open http://127.0.0.1:3212/router directly in Chrome on this Mac for router sign-in. The Admin password is sent only to the detected gateway, never to the hosted site, and is not saved. The resulting session token stays in collector memory. Expiry or service restart requires explicit sign-in again. Local setup writes require the bridge bearer, the exact loopback origin, a dedicated client header, bounded JSON, and rate-limited authentication attempts. The hosted site can read sanitized results but cannot submit router credentials or manual identity writes.
Router-reported client names, addresses, association, Wi-Fi band, and signal fields are displayed only when provided. Client identity joins discovery only by exact normalized MAC within the selected LAN. Names do not establish phone ownership or exact models. Unsupported per-device quantities, destinations, and encrypted message contents remain unavailable; Mac counters are never attributed to other clients. Explicit raw counter fields, if supplied by firmware, are preserved without inventing direction or application meaning.
Rooms start empty. Users add, rename, resize, and move rooms, then drag detected device icons into them or use accessible room selectors. Moving a device between rooms is a manual assignment, not a location observation. Polling does not move assigned devices or interrupt room/device drags. Removing a room unassigns its devices.
Only manual room names, geometry, and opaque placement keys are stored in browser local storage. Manual device identities are instead stored privately by the collector in device-profiles.json with mode 0600. Hashed keys bind them to the observed MAC and selected LAN/gateway, so an IP reused by another device does not inherit the name. Detected identity remains separate from user-assigned names, types and models. Use the local router setup page to add or remove assignments. Telemetry, IP addresses, model names, credentials, and messages are not persisted there. Layouts are local to the browser. No precise positioning source is connected, hardware location support has not been verified, and future estimates must identify their source and uncertainty.
Jarvis snapshot import remains separate from live discovery. Browser sessions are not counted as separate physical devices on House Map. Snapshot activity, Jarvis messages, capture times, and sources remain inspectable, with unknown quantities preserved. Imported content is projected through a bounded parser, rendered safely as text, retained only in page memory, and cleared on request.
Packet Capture opens empty and decodes only a supplied classic PCAP file. Subnet, hash, codec, and port reference tools operate on input/reference data; they do not fabricate scans.
The prior 32 hardcoded nodes, generated 48-link map, random throughput series, running packet counter, periodic fake scans, canned terminal logs, invented threat alerts, example-device tab, and representative packet set were removed from shipped assets. The old network simulation and lab modules are no longer deployed. Synthetic fixtures exist only in tests.
Run node --test test/*.test.mjs. Current checks cover snapshot validation, missing-vs-zero measurements, local scope, interface/subnet validation, bounded discovery, stale handling, counter deltas and resets, authentication, origin restrictions, private configuration, and target rejection. Browser checks cover manual room CRUD/drag/placement, device details, stale collector loss, source separation, import/clear, local utilities, and actual observed collector records.
The primary / route now uses the original cyber console HTML layout, style.css, upgrade.css, graph geometry, display modes and tool positions. The live controller and graph consume authenticated observations; generated counters, packet streams, device seeds, connection links and threat alerts are absent from the live path. The previous expanded House Map/source view is retained at /monitor/. A separate training demo, if opened at /demo/, is clearly labeled and uses isolated preferences. /original/ returns to the primary live console.
The collector samples this Mac's selected physical-interface counters and TCP/UDP socket metadata about every five seconds, with bounded nonprivileged nettop execution and a narrower netstat TCP fallback. Current rows are bounded to 200 for nettop or 60 for fallback. Connection observations are retained only in memory for up to 30 minutes and 1,000 records. Interface charts use at most 30 actual samples. Discovery remains approximately every 30 seconds. Failed or changed scopes stop fresh metadata publication and retain stale evidence.
First/last observed times are source sample times, not actual connection start/end times. Short flows between samples can be missed. Missing rows do not establish closure. DNS queries, full HTTPS URLs, other devices' internet flows and encrypted message contents are unavailable from these socket snapshots. Packet-content recording is off; no interception certificates or encryption changes are installed. See VISIBILITY.md for verified router and wider-path requirements.