L0p4Map - Cybersecurity network tool
𝗟𝟬𝗽𝟰𝗠𝗮𝗽 — Network monitoring, real topology visualization & traffic analysis tool with full nmap integration
GitHub: https://github.com/HaxL0p4/L0p4Map
---
𝗪𝗵𝗮𝘁 𝗟𝟬𝗽𝟰𝗠𝗮𝗽 𝗗𝗼𝗲𝘀
>L0p4Map combines high-speed ARP discovery, deep device fingerprinting, full nmap integration, real network topology mapping, and real-time traffic analysis into a single dark professional interface. It scans local networks and custom targets, fingerprints each host via TTL, TCP port probing and raw SNMP queries, classifies devices by role (gateway, router, AP, switch, PC, mobile, VM, Raspberry Pi...), and builds an authentic hierarchical topology graph — not just a pretty star diagram, but a technically accurate representation of how devices are structured, connected and exposed.
---
𝗙𝗲𝗮𝘁𝘂𝗿𝗲𝘀
- ARP Network Scan — fast host discovery with local IEEE OUI database lookup
- Hostname Resolution — multi-method: reverse DNS, NetBIOS (Windows), mDNS/Avahi (Linux, Mac, IoT)
- Device Fingerprinting — TTL-based OS hint, TCP probing on topology-relevant ports (BGP, Winbox, Zebra, SNMP...), raw SNMP sysDescr query without external libraries
- Role Detection — each host automatically classified as gateway, router, access point, switch, PC, Apple, mobile, Raspberry Pi or VM — combining vendor, hostname, TTL, open ports and SNMP response
- Real Network Topology Graph — hierarchical vis.js graph reflecting the actual network structure: internet → gateway → intermediates (routers/APs/switches) → clients grouped under their parent node. Toggleable between Hierarchical and Force Atlas layouts
- Subnet Bounding Boxes — each subnet drawn as a labeled dashed overlay directly on the graph canvas
- Typed Edges — three visually distinct link types: uplink, backbone, client link
- Full nmap Integration — SYN scan, UDP, OS detection, service version, NSE scripts
- Banner Grabbing — HTTP, SMB, FTP, SSH, SSL enumeration
- Vulnerability Detection — CVE lookup via vulners, vuln and malware scripts
- Attack Surface — per-host view of exposed services, open ports and CVEs with CVSS scoring and direct NVD links; exportable as CSV
- Traffic Analyzer — real-time packet capture with per-device stats, protocol coloring, filter bar, double-click to send IP directly to port scan; exportable as CSV
- Traceroute — ICMP-based with real-time output
- Interface Selection — choose which network interface to scan on
- Live Monitoring — auto-refresh the topology graph at configurable intervals (30s / 60s / 120s)
- Scan / Graph Export — nmap output to .txt, topology as CSV or PNG
- Custom Node Labels — double-click any node on the graph to assign a custom name
- Dark Professional UI — built with PyQt6
---
𝙏𝙖𝙧𝙜𝙚𝙩 𝘼𝙪𝙙𝙞𝙚𝙣𝙘𝙚
Security researchers, network administrators, and students learning network reconnaissance. It's an early-stage but functional tool — not yet production-ready, but solid enough for personal labs, CTF environments, and authorized network auditing.
---
𝗖𝗼𝗺𝗽𝗮𝗿𝗶𝘀𝗼𝗻
Nmap is powerful but terminal-based and outputs raw text. Zenmap (the official nmap GUI) is abandoned and outdated. Wireshark focuses on packet capture rather than topology or attack surface analysis. L0p4Map bridges the gap — it doesn't just wrap nmap in a window, it fingerprints every host independently (TTL, ports, SNMP), infers the real network hierarchy, and renders it as an interactive topology graph that shows you the actual structure of the network you're looking at.
𝗡𝗺𝗮𝗽 𝘄𝗮𝘀 𝗯𝗹𝗶𝗻𝗱. 𝗟𝟬𝗽𝟰𝗠𝗮𝗽 𝘀𝗲𝗲𝘀. 👁