Why We Built NodeRadar Pro
Local networks change constantly. Rogue Wi-Fi devices, misconfigured IoT gadgets and shifting DHCP leases make static network diagrams useless within hours. Most commercial network tools are bloated: sluggish Electron wrappers, invasive installers or mandatory kernel packet drivers (Npcap/WinPcap) that demand admin privileges just to run a simple ping sweep.
NodeRadar Pro fixes that with four clear design rules:
- Single Portable Executable: Compiled with NativeAOT in C# / .NET 10. Runs as an unmanaged native binary without requiring .NET runtimes, SDKs or installer packages.
- Launches in Under 280ms: Cold starts in less than a third of a second and uses under 50 MB of RAM during full-scale active subnet sweeps.
- 100% Offline & Private: Scan history is stored locally in an embedded database protected by AES-256 encryption and Windows DPAPI. Zero external network calls, zero third-party telemetry and zero accounts.
- Zero Kernel Drivers: Discovers LAN devices through native Windows networking APIs (
SendARP) and standard user-mode sockets without installing third-party packet drivers.
How It Works Under the Hood
1. Multi-Threaded Subnet Sweep Engine
NodeRadar Pro runs an asynchronous scanning pipeline directly against user-mode Win32 networking APIs:
- Fast MAC Address Resolution (
SendARP): Queries the Windows kernel neighbor cache first before sending broadcast queries, resolving physical hardware addresses instantly. - Microsecond ICMP Probing: Sends timed ICMP echo requests across configured CIDR subnets (
/24,/23or/16), capturing min/avg/max round-trip times and jitter. Probing is throttled withSemaphoreSlim(64 concurrent sockets) to prevent port exhaustion. - Automated Hardware Identification: Built-in IEEE Organizationally Unique Identifier (OUI) database maps physical MAC prefixes to manufacturers (Apple, Cisco, Ubiquiti, Intel, Raspberry Pi and thousands more).
- Local Service Discovery: Discovers active services via mDNS (Bonjour), SSDP/UPnP and targeted port checks to classify device types automatically.
2. Live Radar Scope Visualizer
Built with Avalonia UI and SkiaSharp, the interface delivers GPU-accelerated 60fps vector rendering with virtually no CPU overhead. Connected devices are arranged dynamically on an interactive radar scope, color-coded by ping latency, packet stability and trust status.
3. Unknown Device Watchdog
A background monitor continuously checks discovered MAC addresses against your authorized device inventory. When an unrecognized device connects to your subnet or an existing IP address changes its physical hardware address (a classic ARP spoofing or MITM indicator), NodeRadar Pro immediately triggers desktop notifications, audio cues and optional SMTP alerts.
Technical Specifications
| Parameter | Specification |
|---|---|
| Language & Runtime | C# 13 / .NET 10 NativeAOT |
| UI Framework | Avalonia UI 12.1 (SkiaSharp GPU Canvas) |
| Compilation Output | Standalone Native x64 Executable |
| Storage Engine | LiteDB with AES-256 & Windows DPAPI |
| Cold Start Latency | ~280ms (SSD, cold cache) |
| Memory Consumption | ~38MB – 52MB during active scans |
| Single-Instance Mutex | NodeRadarPro_App_Mutex_Active |
| Target OS | Windows 10 / Windows 11 (x64) |
| Test Suite | 320+ passing unit and integration tests |
Get NodeRadar Pro
NodeRadar Pro is free, open source and distributed as a standalone portable package: