See every device on your network, and what each one is exposing.
Sonar answers the question every home network eventually raises: what is actually connected to this thing, and should it be? It sweeps the network, names every device, tells you what each one is exposing, and gives you the controls to do something about it — in one native window, with no account and nothing phoning home.
It is free and MIT licensed, written in SwiftUI with no third-party dependencies, and the full source is public — so you can read exactly what it does before you run it on your own network, and reuse any of it.
A ping sweep plus ARP discovery finds everything on the network and resolves it into something readable: IP, MAC, vendor, hostname, then mDNS/Bonjour names and SSDP/UPnP enumeration on top. Randomised MACs are detected rather than silently listed as unknown.
Each device gets fingerprinted — router, Mac, iPhone, printer, camera, NAS, TV, IoT — so the list reads as your house rather than as a column of addresses.
From there you can run an on-demand TCP port scan with service and version banner grabbing, and Sonar flags the exposures that matter: Telnet, open SMB, unauthenticated VNC, exposed databases. New devices raise an alert, presence is kept as history, and anything can be labelled, annotated or marked trusted.
Live link stats — SSID, BSSID, security, channel, band, width, TX rate, SNR — with a signal meter and RSSI history. A nearby-AP scan recommends the least congested channel, which is usually the single change that fixes a slow flat.
Wake-on-LAN magic packets, DNS switching for this Mac (Cloudflare, Google, Quad9, or a custom Pi-hole / NextDNS), and macOS firewall toggling. Quick-launch shortcuts open your router admin, a device's web UI, or an SSH session.
System changes go through macOS's own admin prompt — Sonar never sees your password.
Metrics are recorded every minute and after every scan, and kept on disk for seven days. Charts cover 1h, 6h, 24h and 7d: devices online, throughput, gateway and internet latency. It is the difference between "the internet feels slow" and knowing it has been slow every evening since Tuesday.
Point your router or your devices at NextDNS or a self-hosted Pi-hole v6, and Sonar reads that resolver's log: a live per-device query stream showing which device asked for which domain, when, and whether it was allowed or blocked — filterable by device, searchable by domain, with top-domain and blocked counts.
This is the consent-based answer to "who is browsing what", and it is the only one Sonar offers.
A live up/down throughput chart, per-process bandwidth so you can see which app is actually using the line, join and leave notifications, and export of the whole network map to CSV, JSON or PDF.
Sonar shows who is on your network and what they expose, and controls your own machine and router. It does not intercept, capture or decode anybody else's traffic — no ARP spoofing, no MITM, no packet sniffing, no per-person browsing history.
That is wiretapping even on a network you own, and HTTPS would make the contents unreadable anyway. The DNS-log route above is the honest version of the same question, which is why it is the one that got built.
Everything runs locally. The only outbound calls are the speed test, WHOIS, and IP geolocation — and all three happen because you asked for them.