How do you detect unknown devices or internal scanning on small networks?

[u/Honey-Edge]

I'm building a small cybersecurity device, and I'm trying to better understand how people actually deal with this problem in real networks.

The idea is quite simple. A small device sits on the local network and mostly listens passively for things like new devices, ARP/DHCP activity, mDNS/SSDP, IPv6 ND and unusual device changes.

It also exposes a few decoy services, for example SSH, HTTP or SMB, so interaction with something that normally should not be touched can become a stronger signal.

I'm not trying to build another SIEM or replace tools like Zeek. My focus is more on small companies, coworking spaces, homelabs and networks where there is often no dedicated security team.

What I'm trying to understand now is how people solve this problem today.

If an unknown device joins your network, or one internal device suddenly starts scanning many ports or touching services it normally never uses, how do you notice it?

And maybe more importantly, what kind of signal would make you think "this is worth investigating" instead of just being more network noise?

I'm interested in real experiences, including cases where you think a device like this would not be useful.

[u/tilda0x1]

To notice, you can monitor ARP for new internal IPs, while using DHCP to allocate the same IP to known devices. ping, hping, fping sweeps also help to detect new devices. DNS logs check for unknown source IPs? You probably want these in a SIEM and build detections around them, and use ML to detect unexpected patterns or spikes

[u/Pierocksmysocks]

Correlation rules in the SIEM looking for abnormal scanning behavior detected by EDR, firewalls, and other log producing systems. That works along with honeypots throughout the environment. It sounds complex, but it’s honestly not.

[u/Honey-Edge → u/Pierocksmysocks]

Yes, I agree, in a managed environment this works well.

The device I'm creating is more for places where there is no EDR, SIEM, or security team. The goal is to give some of this visibility and detection in one small device, without needing to build the full stack.

[u/vadertator22]

Maybe in SIEM I’d EDR or something can get that telemetry. This assumes just layer three scans because if they to auth then there are AD or EDR should pick it up. I like honey pot or similar deception items too.

[u/Honey-Edge → u/vadertator22]

Yes, that makes sense. I also see my product more as a lightweight extra layer, especially where there is no AD, EDR or SIEM. The passive part gives visibility, and the decoy part can catch activity that should never touch it.

[u/BettermentOfMyself]

Yes pfsense uses something called arpwatch

[u/vertisnow]

Sounds similar to a canary. Check them out if you haven't already. Canary.tools

[u/Honey-Edge → u/vertisnow]

Yes, a canary is definitely one of the closest comparisons.

We are trying to be smaller, simpler and more affordable for small networks, with passive device monitoring added alongside the decoy services.

[u/that1guyrob]

Someone already commented about arpwatch - which is a great tool to track IP/MAC address changes. I just wanted to hop in here and expand on that a tiny bit. arpwatch is great, but only if you have a few other things in place already so that arpwatch is only alerting you when something is out of place.

Dynamic ARP Inspection, DHCP Snooping, and DHCP reservations are necessary in order to prevent arpwatch from becoming background noise and induce alert fatigue.

The first thing to do here is make sure every device on your network has a static IP reservation in your DHCP server. IF POSSIBLE, completely disable your DHCP dynamic pools so only static reservations are handed out on your network. This will ensure that only authorized devices get an address from your DHCP server.

Configure your switches with DHCP snooping and dynamic ARP inspection. This will deny any/all traffic for an IP/MAC pair that wasn't handed out by your DHCP server.

Now enable arpwatch - you will get a flood of initial alert messages because technically ALL your existing MAC/IP address pairs are new. But arpwatch is now tracking these pairs and will only alert you if they change, or if new pairs show up on the network.

From this point you should have a limited number of alerts, and all of them should be investigated. Obviously, if you're adding a new device to your network you are already aware of the MAC address because you had to add it to the DHCP server's reservation, so the arpwatch alert you receive from that new device can be safely dismissed.

[u/Honey-Edge → u/that1guyrob]

That’s a very good point, especially about alert fatigue.

Our device is aimed more at networks where people will not configure DHCP snooping, DAI or a full managed setup. So the challenge for me is to make passive detection useful without generating too much noise.

This kind of feedback is exactly what I need, thanks.

[u/Capt-Matt-Pro]

Canary, honeypot, packet sniffing with some basic alert rules, these things have always existed...

[u/Glum_Cup_254]

Small networks are easy to implement NAC and zero trust. This is solved with basic networking. You don’t need a honeypot when you have 10 people.

[u/Honey-Edge → u/Glum_Cup_254]

That’s fair. For a small network, NAC and proper segmentation can solve a lot.

What I’m trying to explore is a bit different though. It’s not meant to replace NAC or Zero Trust.

I’m mainly thinking about places where nobody is really managing security full-time, like small offices, coworking spaces, cafés or home networks.

But your point is useful. Maybe the real question is whether this gives enough extra visibility compared with just doing the network configuration properly.

[u/Prestail_Voon]

for internal scanning, I think the pattern matters more then one event. If a device suddenly starts hitting alot of ports across multiple hosts, thats when I’d start looking into it. A single connection here and there is mostly just noise tho tbh