Open source · MIT · v0.6.4
SentinelAI watches your network's traffic, spots port scans, floods and network sweeps, and tells you what each alert means and what to do about it. It runs on your own hardware.
Real numbers, real traffic
Five full days of CIC-IDS2017 replayed through the real detection pipeline. Each labelled flow counts as caught only if SentinelAI alerted on that connection while it was happening.
A port scan, an HTTP flood and a botnet, in 9.9 million packets.
| Attack | Flows | Caught | Minutes |
|---|---|---|---|
| Port scan | 158,924 | 99.7% | 12 of 26 |
| DDoS (HTTP flood) | 128,027 | 99.9% | 21 of 21 |
| Botnet (Ares) | 1,966 | 23.9% | 387 of 592 |
CIC-IDS2017, Canadian Institute for Cybersecurity. Friday's thresholds were partly tuned on the same day. Wednesday and Monday were held out: every threshold was frozen before they were replayed. Tuesday and Thursday were kept untouched to test the 0.6.2 connection-flood fix, which failed its target there (details in the evaluation). All five days are shown with 0.6.2's rules.
Features
A handful of readable rules, a dashboard that explains itself, and everything on your own hardware.
01 — Detection
Nine rules, each a few lines of Python with thresholds in one config file.
02 — Alerts
Every alert says what happened, whether the source is on your network or the internet, the evidence behind it, and what to do next.
03 — Notifications
High-severity alerts reach your phone in seconds, through your own ntfy server, email, Discord, Slack or Telegram. Each one names the devices involved and opens the alert in the dashboard.
04 — Names
Give your devices names like Living room TV, and optionally let SentinelAI learn which sites they talk to, so an alert reads Office laptop → api.example.com instead of two IP addresses.
05 — Review
Mark alerts as reviewed one at a time or in bulk. The dashboard only asks for attention while something is unreviewed, then settles back to calm.
06 — Anomaly model
An Isolation Forest trained on your own network's normal traffic flags what doesn't fit. It's off until you train it, and its alerts are never rated high.
07 — Resilience
Everything SentinelAI keeps has a hard limit, in memory and on disk, so it can run for months without filling up your machine. Ten million spoofed connections leave its memory flat at about 410 MB.
08 — Privacy
Everything runs on your hardware. By default it reads packet headers, not contents; optional hostname learning reads only DNS answers, HTTP Host headers and TLS server names. Every service listens on this machine only, unless you set a password and open the dashboard to your phone. Notifications go to your own ntfy server unless you choose email or a chat app. Nothing is downloaded unless you turn on the optional botnet-server list. No account, no cloud.
09 — Demo
make demo replays seven kinds of simulated attack against a full local install, no root needed. The fake internet attackers use addresses reserved for documentation, so they can't be mistaken for real ones.
What it can't do
Traffic between two devices on the same Wi-Fi access point never crosses a wire SentinelAI can watch. Traffic to and from the internet is still seen, but a laptop scanning your smart TV over Wi-Fi isn't.
Packet capture runs in Python. Its speed on a Raspberry Pi hasn't been measured yet, and on a saturated link it may miss packets.
Slowloris sends almost no traffic, by design, and was missed completely. Password guessing over FTP and SSH looks like ordinary logins. Heartbleed and web attacks such as SQL injection live inside the traffic's contents, which SentinelAI doesn't read. All were 0% in testing. And a flood that stops within a second isn't reported, so that normal bursts of connections don't raise alarms.
SentinelAI tells you what's happening. It never drops traffic, so a false alarm can't take your internet down.
What's next
None of this exists today. Each has a written plan, with what it must do before it ships.
A Raspberry Pi 4 or 5 on a mirror port of your switch, watching every device and starting on boot.
A model on your own network adds a verdict and a reason to each alert. Advice only: it can never hide or downgrade one.
FAQ
Pi-hole blocks ads and trackers by refusing DNS lookups for known domains. SentinelAI doesn't block anything: it watches traffic for attack patterns such as scans, floods and sweeps. They do different jobs and run happily side by side.
Suricata matches traffic against thousands of known attack signatures and reads packet contents. Zeek turns traffic into detailed logs for analysts. Both are mature and more thorough. SentinelAI is smaller: a few readable rules, a dashboard that explains each alert, and results published with their misses. If you need an enterprise IDS, use Suricata.
A Mac or Linux machine with Docker. A Raspberry Pi 4 or 5 is planned as the recommended setup, but its installer isn't built yet, so it isn't supported today.
On its own, SentinelAI sees the traffic of the machine it runs on. To see every device, give it a copy of the traffic: a managed switch with port mirroring (about R350–R1,000) is the simplest and safest; a Raspberry Pi set up as a bridge between your router and your network sees everything but becomes a single point of failure; some routers can capture traffic themselves.
Yes. Set a password, set DASHBOARD_BIND=0.0.0.0, and open the dashboard at your computer's address. Away from home, use Tailscale, a free private network between your own devices, rather than opening a port on your router. The README has the steps.
Not yet. It's an early release, a learning and home-lab tool rather than a replacement for a professional security product. The numbers on this page are honest, including where it fails.
Only monitor networks you own or have explicit permission to monitor. Capturing other people's traffic without consent is illegal in many countries.
Get started
On a Mac or Linux machine with Docker and make. The demo simulates attacks, so you can see detection working in two minutes.
$ git clone https://github.com/smngvlkz/sentinel.git$ cd sentinel$ make demo # then open http://localhost:3001To watch your real network instead, run make setup, set CAPTURE_INTERFACE in .env, then make up and make capture.
A Raspberry Pi 4 or 5 on a mirror port of your switch, watching every device and starting on boot.
Install steps will appear here once the Raspberry Pi installer is built. See what's next.
Only monitor networks you own or have explicit permission to monitor.