Intrusion Detection with a Network Scanner

You can't defend what you can't see. A lightweight intrusion-detection approach for a home/fleet network: baseline known devices, then alert on anything new appearing on the LAN or tailnet.

#The approach

cron → sweep the network → diff against known-hosts → alert on new MAC/IP

#Sweep the network

# fast host discovery on the LAN
sudo nmap -sn 192.168.1.0/24 -oG - | awk '/Up$/{print $2}'
# tailnet devices
tailscale status --json | jq -r '.Peer[].TailscaleIPs[0]'

#Diff against a baseline

sudo nmap -sn 192.168.1.0/24 -oG - | awk '/Up/{print $2}' | sort > /tmp/now.txt
comm -13 known-hosts.txt /tmp/now.txt > new-hosts.txt     # lines only in "now"
[ -s new-hosts.txt ] && notify "New device(s): $(cat new-hosts.txt)"

On this fleet: a cron scanner maintains the known-device list and pushes new-device alerts. Pair with host firewalls (Firewall with ufw and nftables) and centralized logs. For deeper monitoring, consider Suricata/Zeek on a mirror port.