A one-page safety report for each smart device on your network

I kept running into the same problem with my own smart home gear: I could capture the traffic, but turning a pcap into something I could actually read (or hand to a family member) took an evening. So I built that part into iotaudit, an open source (MIT) tool that watches what devices on your own network do and writes a report.

The last few releases were all about making that report short and honest. Here is what each device gets now.

An A-F grade plus one line

Since 0.1.6 every device has a one-line verdict next to its grade. It looks like this:

D: Telnet open on the LAN; uses public DNS directly; TLS cloud traffic (US); custom encryption (unverified).

The verdict is the short version of the findings below it. Open ports, public DNS use, TLS versus plaintext, and destination countries are things iotaudit actually observed. Anything it is guessing about is labeled as such, like "(unverified)" above. The same string is in the JSON report as verdict, so you can script against it.

Countries and traffic patterns, kept separate

In 0.1.5 I split the report into two kinds of statements, because mixing them was misleading:

• Destination countries (observed). For each device the report lists the countries of the IPs it contacted, with byte counts, from a local offline lookup. This is in the JSON as destination_countries.
• Traffic patterns (indicators). Video, audio, telemetry, or unknown, each with a low, medium, or high confidence. A pattern match is not proof of what was sent, and the report says so.

So "talked to servers in the US" is a fact, while "looks like a video stream, medium confidence" is a hint. If you want the story of why that distinction mattered to me, I wrote about a pet feeder whose video I could not capture.

New in 0.1.8: PDF export

HTML is fine on my laptop, but a PDF is easier to share or keep. PDF support is an optional extra (it uses xhtml2pdf, pure Python):

pip install "iotaudit[pdf]"

# Analyze a capture and write report.pdf next to report.html
iotaudit analyze capture.pcap --device 192.168.1.50 --out report.html --pdf

# Or convert a report you already saved (HTML or JSON)
iotaudit report --pdf report.html
iotaudit report --pdf results.json --out results.pdf

--pdf also works on iotaudit capture. Print styles put the grade and verdict at the top of each device, so the first thing you see on each page is the summary. The on-screen traffic chart is left out of the PDF. If the extra is not installed, analyze and capture still write the HTML and print the one install line you need.

The ground rules

• It is meant for your own network and your own devices only, and active steps ask for explicit consent.
• All data stays local. GeoIP lookups use bundled offline databases.
• No telemetry. The tool does not phone home.

The IP addresses in this post are generic examples, not from a real network.

If you also want to check what your router opened for your devices, that is covered in my earlier post on listing UPnP port forwards read only.

Feedback and issues are welcome on GitHub. I am especially curious which verdicts feel wrong on your devices.