Open source · MIT · v0.2.0
SentinelAI watches your network's traffic, spots port scans, floods and network sweeps, and tells you what each alert means and what to do about it. It runs on your own hardware.
Real numbers, real traffic
Three full days of CIC-IDS2017 replayed through the real detection pipeline. Each labelled flow counts as caught only if SentinelAI alerted on that connection while it was happening.
A port scan, an HTTP flood and a botnet, in 9.9 million packets.
| Attack | Flows | Caught | Minutes |
|---|---|---|---|
| Port scan | 158,924 | 99.7% | 13 of 26 |
| DDoS (HTTP flood) | 128,027 | 99.9% | 21 of 21 |
| Botnet (Ares) | 1,966 | 23.9% | 387 of 592 |
CIC-IDS2017, Canadian Institute for Cybersecurity. Friday's thresholds were partly tuned on the same day. Wednesday and Monday were held out: every threshold was frozen before they were replayed.
Features
A handful of readable rules, a dashboard that explains itself, and everything on your own hardware.
01 — Detection
Eight rules, each a few lines of Python with thresholds in one config file.
02 — Alerts
Every alert says what happened, whether the source is on your network or the internet, the evidence behind it, and what to do next.
03 — Review
Mark alerts as reviewed one at a time or in bulk. The dashboard only asks for attention while something is unreviewed, then settles back to calm.
04 — Anomaly model
An Isolation Forest trained on your own network's normal traffic flags what doesn't fit. It's off until you train it, and its alerts are never rated high.
05 — Privacy
Everything runs on your hardware. It reads packet headers, not contents, and every service listens on 127.0.0.1 only. No account, no cloud.
06 — Demo
make demo replays seven kinds of simulated attack against a full local install, no root needed. The fake internet attackers use addresses reserved for documentation, so they can't be mistaken for real ones.
What it can't do
Traffic between two devices on the same Wi-Fi access point never crosses a wire SentinelAI can watch. Traffic to and from the internet is still seen, but a laptop scanning your smart TV over Wi-Fi isn't.
Packet capture runs in Python. Its speed on a Raspberry Pi hasn't been measured yet, and on a saturated link it may miss packets.
Slowloris sends almost no traffic, by design, and was missed completely. Heartbleed lives inside encrypted traffic, which SentinelAI doesn't read. Both were 0% in testing.
SentinelAI tells you what's happening. It never drops traffic, so a false alarm can't take your internet down.
What's next
None of this exists today. Each has a written plan, with what it must do before it ships.
A Raspberry Pi 4 or 5 on a mirror port of your switch, watching every device and starting on boot.
High-severity alerts through ntfy, email or a webhook, with quiet hours and rate limits.
A model on your own network adds a verdict and a reason to each alert. Advice only: it can never hide or downgrade one.
FAQ
Pi-hole blocks ads and trackers by refusing DNS lookups for known domains. SentinelAI doesn't block anything: it watches traffic for attack patterns such as scans, floods and sweeps. They do different jobs and run happily side by side.
Suricata matches traffic against thousands of known attack signatures and reads packet contents. Zeek turns traffic into detailed logs for analysts. Both are mature and more thorough. SentinelAI is smaller: a few readable rules, a dashboard that explains each alert, and results published with their misses. If you need an enterprise IDS, use Suricata.
A Mac or Linux machine with Docker. A Raspberry Pi 4 or 5 is planned as the recommended setup, but its installer isn't built yet, so it isn't supported today.
On its own, SentinelAI sees the traffic of the machine it runs on. To see every device, give it a copy of the traffic: a managed switch with port mirroring (about $30–60) is the simplest and safest; a Raspberry Pi set up as a bridge between your router and your network sees everything but becomes a single point of failure; some routers can capture traffic themselves.
Not yet. It's an early release, a learning and home-lab tool rather than a replacement for a professional security product. The numbers on this page are honest, including where it fails.
Only monitor networks you own or have explicit permission to monitor. Capturing other people's traffic without consent is illegal in many countries.
Get started
On a Mac or Linux machine with Docker and make. The demo simulates attacks, so you can see detection working in two minutes.
$ git clone https://github.com/smngvlkz/sentinel.git$ cd sentinel$ make demo # then open http://localhost:3001To watch your real network instead, run make setup, set CAPTURE_INTERFACE in .env, then make up and make capture.
A Raspberry Pi 4 or 5 on a mirror port of your switch, watching every device and starting on boot.
Install steps will appear here once the Raspberry Pi installer is built. See what's next.
Only monitor networks you own or have explicit permission to monitor.