Sharing a tool I built for my own rack. Sloth is a terminal network monitor written in C99, no third-party deps. It reads what the interface already sees and renders it into 27 views plus 6 alert rules. Strictly passive, so it is safe to leave running on a mirror port or on any host.
Homelab-relevant bits:
– Runs headless with make embedded (no ncurses, no libpcap). Fine on a Pi or a small OpenWrt device.
– JSONL output for every DNS / TLS / QUIC / HTTP / NTP / ICMP record and every alert. Ships straight to Loki, Elastic, or a Grafana pipeline.
– Alerts: port scans, deauth floods, NXDOMAIN bursts, threat-intel domain and IP hits, periodic beaconing. Each alert can dump a per-alert pcap.
– Passive WiFi SIGINT on a monitor-mode iface: PNL per client MAC, hidden SSID reveal, EAPOL / PMKID capture in hashcat 22000 format.
Not trying to replace ntop or Zeek. It is one small binary you can drop on a sensor node and read from the terminal or ingest downstream.
Repo, per-view docs, and JSONL schema:
https://github.com/spacetrucker2196/sloth
Feedback welcome, especially from anyone running a Pi sensor on a SPAN port.
Source: r/homelab · by /u/Defiant_Photograph86