PARANOID

Paranoid uses a proprietary multi-phase discovery pipeline that combines ARP table prepopulation, TCP probing, Bonjour/mDNS, NetBIOS, SSDP/UPnP, and SNMP to achieve near-100% host detection rates. Unlike simple ICMP-based scanners, Paranoid discovers devices even when they have no open TCP ports and block ping requests. The discovery engine uses a blocking ARP prepopulation phase followed by an immutable ARP snapshot, ensuring zero race conditions during concurrent scanning.

Paranoid combines six identification protocols with cloud-powered enrichment to reveal not just IP addresses, but the exact make, model, operating system, and owner of every device. The 3-tier vendor lookup starts with a local IEEE OUI database, falls back to an online API, and has a built-in embedded database as a last resort—so identification works even offline.

From quick-check of common ports to deep scans of all 65,535, Paranoid uses the same nmap service probe database used by professionals worldwide. Banner grabbing sends protocol-specific probes ordered by rarity, matches responses against thousands of regex signatures, and extracts exact product names, versions, and CPE identifiers.

The Privileged Helper is an XPC service that runs alongside Paranoid with elevated permissions, unlocking advanced scanning techniques that require root access. Install it once with your administrator password, and it auto-updates silently whenever you update Paranoid—no repeated password prompts. The helper enables six powerful capabilities that are impossible without root access on macOS.

Paranoid's built-in honeypot transforms your Mac into a decoy target that lures attackers into revealing themselves. It emulates four commonly-targeted protocols with realistic banners and interactive responses that fool automated attack tools and manual intruders alike. Every connection attempt, credential, and shell command is captured, timestamped, and stored. When an attacker exceeds your configured threshold, their IP is automatically blocked—and you can export the block list directly to the macOS PF firewall.

The Traffic Inspector is a real-time host-based intrusion detection system that monitors all TCP and UDP connections on your Mac. Every 2 seconds (configurable from 1 to 10 seconds), it queries the operating system's network stack via netstat and correlates each connection to its responsible process using lsof. It then analyzes traffic patterns against 42 pre-compiled regular expressions to detect active attacks in real time. The system learns your normal traffic baseline and flags anomalies that deviate from established patterns.

Paranoid's vulnerability scanner combines real-time lookups against the NIST National Vulnerability Database (NVD API 2.0) with a pre-seeded offline SQLite database for air-gapped environments. The CPE Guesser module automatically generates Common Platform Enumeration identifiers from detected service banners using 160+ vendor mappings, then searches for matching CVEs across multiple data sources. The WeaknessScorer separately analyzes port configurations for common security misconfigurations that don't have CVE entries but are equally dangerous.

WiFi Guard continuously monitors your wireless connection every 4.5 seconds (configurable 0.5–5.0s) for the most dangerous WiFi-based attacks. It watches your BSSID, signal strength, gateway MAC address, and security protocol level simultaneously. A correlation engine requires at least two MITM indicators within a 30-second window before raising an alarm, eliminating false positives from normal WiFi roaming while catching real attacks.

Bluetooth Guard scans for both BLE (Bluetooth Low Energy) and Classic Bluetooth devices in your vicinity, classifying them by type, estimating their distance, and assessing their security posture. It maintains a baseline of known devices and alerts you when unexpected devices appear—including tracking devices like AirTags, Tile trackers, and Pebblebee beacons that may be following you. The GATT service enumeration reveals exactly what capabilities each device exposes.

Paranoid uses a two-layer detection system to find IP cameras on any network, even when they're disguised or configured to avoid discovery. Layer 1 is brand-agnostic, using OUI lookups, hostname patterns, Bonjour services, SSDP analysis, and active RTSP/ONVIF/HTTP probing. Layer 2 activates deep, brand-specific detection with binary protocol fingerprinting for specific camera manufacturers. A weighted scoring system (0-100) provides confidence levels: Confirmed (≥60), Suspicious (30-59), and Unlikely (<30).

Your router is the front door to your network, and most people have no idea what's exposed. Paranoid discovers your gateway via UPnP IGD (Internet Gateway Device) protocol, enumerates all port mappings (forwards) configured via UPnP, detects NAT-PMP support, and calculates a security score from 0 to 100 based on what services are exposed to the internet.

Paranoid goes beyond listing devices—it identifies the people using your network. By analyzing hostnames, Bonjour names, NetBIOS names, and mDNS records, it extracts person names and associates them with their devices. Multi-source merging combines evidence from different protocols, and a confidence scoring system (High/Medium/Low) indicates how certain each identification is. Results persist across sessions so you build a complete picture of who has been on your network over time.

Paranoid integrates the IPGeolocation API to provide detailed geographic and threat intelligence for any IP address. Look up your public IP to see what the internet knows about you, or analyze external IPs to assess their risk. The security module detects VPNs, proxy servers, Tor exit nodes, and bot traffic, assigning a threat score from 0 to 100. All results are cached locally for 7 days to minimize API calls.

Save a snapshot of your network as a "profile"—a baseline of all known, authorized devices. On every subsequent scan, Paranoid compares the current network state against your baseline and instantly flags any deviations: new unauthorized devices, missing devices, IP changes, MAC changes, and new open ports. This is the foundation of network intrusion detection—if you know what should be there, you can instantly spot what shouldn't.

The Network Monitor runs continuous background scans at configurable intervals, tracking device presence in real time. It uses a 3-miss threshold before marking any device as offline (preventing false alerts from momentary network hiccups). Combined with the automation engine, you can define rules that trigger webhooks, generate reports, or send notifications based on specific network events. The scan scheduler supports cron-like scheduling for unattended operation.