WatchYourLAN - Self-Hosted Network Device Scanner

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## WatchYourLAN - Self-Hosted Network Device Scanner

WatchYourLAN is an open-source, lightweight network scanner with a clean web dashboard. It periodically scans the network the instance sits on, discovers every device it can see, and records each host's MAC address, IP address, name and vendor along with a full online and offline history - so you always know what is connected and get an immediate signal when something new appears.

This AMI delivers the official WatchYourLAN 2.1.4 release as a single pinned static binary with real systemd services and a SQLite datastore, ready within minutes of launch.

## Why This AMI Instead of Self-Deploying

Choosing this AMI over manually installing WatchYourLAN on a bare instance or running the container image gives you three concrete advantages:

• Hours saved on hardening: The binary is checksum-verified at build time, bound to loopback, and fronted by an authenticating reverse proxy - the secure setup you would otherwise assemble by hand.
• No container overhead: A native systemd service with a SQLite store means no Docker daemon to run or patch, reducing resource use and attack surface.
• Ongoing maintenance handled: cloudimg tracks upstream releases, rebuilds verified AMIs, and provides 24/7 support, so you do not maintain the build pipeline yourself.

## What It Scans on AWS (please read)

WatchYourLAN discovers devices by ARP scanning the network interface of the instance it runs on. On EC2 that means it sees the hosts reachable on the instance's own VPC subnet - other instances and network interfaces in the same subnet - or a network you attach at layer 2 over a VPN or overlay. It does not scan arbitrary networks and it cannot reach across the public internet. A single instance in an otherwise-empty subnet will legitimately show few or no neighbours; place it on a subnet whose devices you want to inventory, or bridge your on-premises network to it over a VPN, to get a full picture.

## Working With AWS Services

• Load balancer health checks: The image serves an anonymous health endpoint on port 80 that answers without credentials, so an Application Load Balancer target group (or any external uptime monitor) can health-check the instance.
• Hybrid inventory over a VPN: Bridge an on-premises network to your VPC with an AWS Site-to-Site VPN (or an overlay), point WatchYourLAN at that interface, and it inventories the office and the cloud side by side.
• REST API: Every discovered host is queryable over the authenticated REST API, so you can feed the inventory into your own asset register or CMDB.

## Secure by Default

WatchYourLAN has no built-in login of its own upstream. Exposing a network scanner's dashboard unauthenticated on a public IP would leak your network topology, so this image closes that gap: the application binds to loopback, an authenticating reverse proxy fronts it, and a fresh administrator password unique to each instance is generated on first boot and written to a root-only file. No shared or default credential exists anywhere in the image. The pinned release binary is verified against a published checksum at build time, and the image is hardened and fully patched.

## Getting Started

1. Launch the instance on the VPC subnet whose devices you want to inventory

2. Read the per-instance admin password from the credentials file over SSH

3. Open the dashboard in a browser and sign in to see every host WatchYourLAN has discovered

4. Query the same data programmatically through the built-in REST API

For a detailed walkthrough including how to widen the scan to an on-premises network over a VPN and how to change the dashboard password, see the paired deploy guide.

## Use Cases

• Continuous device inventory: A running, self-hosted record of every host on a subnet, with MAC, IP, name and vendor for each
• Spotting new arrivals: An immediate signal when an unrecognised device appears on the network you are watching
• A private network dashboard you own: Host online and offline history and a REST API, entirely self-hosted with no third-party service

## Open-Source Community

WatchYourLAN is an actively maintained open-source project. This AMI packages the upstream release as a production-ready appliance so you benefit from community-driven updates without maintaining the build pipeline yourself.

## cloudimg Support

24/7 technical support by email and chat. Our engineers help with deployment, scoping the scan to the right subnet, bridging on-premises networks over a VPN, and upgrade planning.

All product and company names are trademarks or registered trademarks of their respective holders. WatchYourLAN is published under the MIT License. Use of the name identifies the software and does not imply affiliation with or endorsement by the WatchYourLAN project.