bearnet: live network graph + world map + IP intelligence + deep OSINT#92
Merged
Conversation
Rebuilds BearNet from a paper-tiger table into a real Little Snitch-style tool: - capture-sidecar/netmon.rs: a live connection monitor that polls the OS connection table (lsof) for established outbound TCP, reverse-resolves remote IPs to owners, classifies, and streams connections open/close. NEEDS NO ROOT — this is the real, working network surface. Scope toggle (browser-only vs whole machine) via /scope. Verified live: shows real firefox/system connections off this Mac. - settings/start/bearnet.html: a force-directed canvas graph — this machine at center, remote endpoints radiating out, sized by connection count, colored by category (tracker/analytics/cdn/other), click-to-block. Replaces the table. - bpf.rs: the honest capture story. /capture/status now reports canCapture (can we actually open a BPF device) vs available (engine installed). When available but not permitted, the panel offers a REAL one-time Enable (/capture/enable → installs the ChmodBPF launchd helper + access_bpf group via one admin prompt, Wireshark's mechanism) instead of a dead error. Diagnosed on this Mac: dumpcap present, /dev/bpf* root-only, no ChmodBPF → that's why capture was a paper tiger; enable fixes it for real. - capture-enable action added to the contract (prohibited → gated only on user gesture; an agent can never install a privileged helper). Containment 16/16. Not merged — for review first, per 'hear what we've got before we build'.
Browser HTTPS sockets are ephemeral — reaping a node the instant its socket left lsof made domains pop in and vanish. Now a connection lingers 25s after its last sighting before ConnectionClosed fires (timestamp refreshed on every sighting, so live domains never age out); the panel revives a node on resumed traffic and fades a dead one slowly (0.04 vs 0.15 easing) instead of popping. Verified: domain node set held steady over a 20s sample.
…/RDAP Turns BearNet into a real network-intelligence tool, sovereign by design: LOCAL, zero-leak (bundled DBs, no network — a privacy browser must never leak the IPs you're connected to just to draw a map): - geo.rs: DB-IP City Lite + ASN Lite (MaxMind format, CC-BY) → every endpoint resolves to city/country/lat-lon + ASN + owning org instantly. Verified: 1e100.net→Mountain View/Google AS15169, amazonaws→Ashburn/Amazon AS14618. - Panel Map view: equirectangular world (Natural Earth, public domain, slimmed to 152KB) with endpoint dots at their real locations, colored by category, sized by connection count. Graph|Map toggle. ON-CLICK, user-initiated + gated (external — sends the peer IP out, so an agent can never quietly fingerprint your connections): - /whois via RDAP (curl → rdap.org bootstrap → authoritative RIR): structured, fast (system whois referral-chains 12–75s; RDAP is <1s). Returns netblock owner / CIDR / net name / type / allocation + last-changed dates. Verified: 142.250… → Google 142.250.0.0/15 alloc 2012; 140.82… → GitHub /20 alloc 2018. 12s subprocess timeout so a slow registry never hangs. - 'whois' action added to contract: prohibited → gated only on user gesture. Panel detail popover: local geo/ASN shown instantly on click; 'Investigate' button fires the gated RDAP lookup and fills in registry ownership. Both Graph and Map share the node model, click-to-block, honest capture strip. DBs: ASN (9.6MB) bundle-friendly; city (131MB) gitignored — staged at package time or swap to country-level for a lighter bundle. Containment still green.
Adds /osint — a gated, user-initiated fan-out to several FREE, no-key sources in
parallel (each best-effort + independently timed out). Answers the rest of the
'what else could we show' wishlist:
- RDAP → owner / CIDR block / type / allocation + last-changed / abuse contact
- Shodan InternetDB → open ports, known CVEs/vulns, hostnames (what's RUNNING)
- HackerTarget reverse-IP → other domains sharing the IP ('what else on the range')
- crt.sh cert transparency → subdomains (best-effort; crt.sh 502s often)
Governance: 'osint' action is prohibited → gated only on user gesture — these
send the IP/domain to third parties, so an agent can NEVER fire them; only an
explicit Investigate click, carrying a token. Verified live: github.com →
GitHub Inc / 140.82.112.0/20 / ports [22,80,443] / 7 other domains on the IP;
agent → 403. Panel Investigate now renders all sections (registry/host/other
domains/subdomains). Fetched via curl (no TLS dep). Containment 16/16 green.
Deferred (needs a paid provider + key, flagged to user): full HISTORICAL block
ownership (SecurityTrails/WhoisXML). Architecture slots it in as another gated
source.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebuilds BearNet from the v1 paper-tiger table into a real Little Snitch-class network-intelligence tool. All verified live against real traffic on macOS.
Views
lsofconnection monitor (25s grace so it doesn't flicker). Browser / Whole-machine scope toggle.Intelligence (sovereign two-tier)
Governance
New
capture-enable,whois,osintactions — all prohibited → gated only on explicit user gesture. Containment test 16/16. Also made raw pcap honest: real BPF-capability detection + a working one-time ChmodBPF "Enable" (Wireshark's mechanism) instead of a dead error.assemble-cockpit.sh, not the browser nightly lanes — so this ships the panel (bearnet.html + world.json, in omni.ja) but the data feed needs the sidecar baked into the .app + auto-launched (the BB docs: handoff — bake the sovereign cockpit into the browser #77 lane). Panel degrades honestly to "offline" without it.Deferred (needs paid provider+key): full historical block ownership.