# cirno-mira/net-ops-toolbox architecture

> Architecture diagram of the GitHub repository cirno-mira/net-ops-toolbox, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/cirno-mira/net-ops-toolbox
- Repository: https://github.com/cirno-mira/net-ops-toolbox

## Overview

NetOps Toolbox is a PyQt5 network-operations and CTF desktop application. The principal workflow is selecting a tool in the main window, running a network discovery or diagnostic task, and inspecting results in its page or the shared log. Its features also cover traffic redirection and interception, packet analysis, security checks, reporting, and operational utilities. The graph follows documented UI-to-core links and README-described capabilities; some feature relationships are documented rather than verified from source excerpts.

Main entry points: [`ui/main_window.py`](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/main_window.py) (Main window), [`core/report.py`](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/report.py) (Report generation), [`ui/tab_arp.py`](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_arp.py) (ARP control page), [`ui/tab_assets.py`](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_assets.py) (Asset discovery page)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interface["Application interface"]
  node_entry["Application startup<br/>[main.py]"]
  node_window["Main window<br/>[main_window.py]"]
  node_shared_ui["Shared UI widgets<br/>[widgets.py]"]
end

subgraph group_discovery["Discovery and scanning"]
  node_assets_ui["Asset discovery page<br/>[tab_assets.py]"]
  node_assets_core["Asset discovery<br/>[assets.py]"]
  node_ports_ui["Port scan page<br/>[tab_ports.py]"]
  node_ports_core["Port scanning<br/>[ports.py]"]
  node_dir_ui["Directory brute page<br/>[tab_dirbrute.py]"]
  node_dir_core["Directory brute force<br/>[dirbrute.py]"]
end

subgraph group_traffic["Traffic interception"]
  node_arp_ui["ARP control page<br/>[tab_arp.py]"]
  node_arp_core["ARP redirection<br/>[arpmitm.py]"]
  node_dns_core["DNS redirection<br/>[dnsspoof.py]"]
  node_mitm_ui["Traffic interception page<br/>[tab_mitm.py]"]
  node_mitm_core["Transparent proxy<br/>[mitm.py]"]
  node_tunnel_ui["Tunnel page<br/>[tab_tunnel.py]"]
  node_tunnel_core["Port forwarding and shell<br/>[tunnel.py]"]
  node_fake_ui["Fake services page<br/>[tab_fakeserv.py]"]
  node_fake_core["DNS and HTTP services<br/>[fakeserv.py]"]
end

subgraph group_analysis["Analysis and security"]
  node_capture_ui["Packet capture page<br/>[tab_capture.py]"]
  node_capture_core["Packet capture and streams<br/>[capture.py]"]
  node_vuln_ui["Security check page<br/>[tab_vuln.py]"]
  node_vuln_core["Security probes<br/>[vulncheck.py]"]
  node_report_ui["Report export page<br/>[tab_report.py]"]
  node_report_core["Report generation<br/>[report.py]"]
end

subgraph group_operations["Operations and support"]
  node_logs["Log bus<br/>[logging_bus.py]"]
  node_host["Host network info<br/>[hostinfo.py]"]
  node_hash_ui["Hash tools page<br/>[tab_hash.py]"]
  node_hash_core["Hash and dictionary tools<br/>[hashkit.py]"]
  node_tools_ui["Operations tools page<br/>[tab_tools.py]"]
  node_tools_core["Operations utilities<br/>[tools.py]"]
  node_diag_ui["Environment diagnostics page<br/>[tab_diag.py]"]
  node_netdiag["Network diagnostics<br/>[netdiag.py]"]
end

node_user(("Operator"))

node_user -->|"starts"| node_entry
node_entry -->|"opens"| node_window
node_window -->|"routes to"| node_assets_ui
node_window -->|"routes to"| node_ports_ui
node_window -->|"routes to"| node_arp_ui
node_window -->|"routes to"| node_mitm_ui
node_window -->|"routes to"| node_capture_ui
node_window -->|"routes to"| node_dir_ui
node_window -->|"routes to"| node_vuln_ui
node_window -->|"routes to"| node_report_ui
node_window -->|"routes to"| node_hash_ui
node_window -->|"routes to"| node_tunnel_ui
node_window -->|"routes to"| node_fake_ui
node_window -->|"routes to"| node_tools_ui
node_window -->|"routes to"| node_diag_ui
node_assets_ui -->|"runs scans"| node_assets_core
node_ports_ui -->|"runs scans"| node_ports_core
node_dir_ui -->|"runs probes"| node_dir_core
node_arp_ui -->|"controls"| node_arp_core
node_arp_ui -->|"starts DNS"| node_dns_core
node_arp_ui -->|"requests proxy"| node_mitm_ui
node_mitm_ui -->|"controls"| node_mitm_core
node_capture_ui -->|"captures packets"| node_capture_core
node_vuln_ui -->|"runs checks"| node_vuln_core
node_report_ui -.->|"exports results"| node_report_core
node_hash_ui -->|"runs tools"| node_hash_core
node_tunnel_ui -->|"controls"| node_tunnel_core
node_fake_ui -->|"controls"| node_fake_core
node_tools_ui -->|"runs utilities"| node_tools_core
node_diag_ui -.->|"runs diagnostics"| node_netdiag
node_assets_core -->|"probes discovered hosts"| node_ports_core
node_assets_ui -->|"imports targets"| node_arp_ui
node_logs -->|"publishes messages"| node_shared_ui
node_shared_ui -->|"renders in"| node_window
node_assets_ui -->|"uses network info"| node_host
node_arp_core -->|"checks interfaces"| node_host
node_arp_core -.->|"coordinates redirection"| node_dns_core
node_mitm_core -.->|"forwards optionally"| node_fake_core
node_report_core -.->|"collects results"| node_assets_core
node_report_core -.->|"collects results"| node_ports_core
node_report_core -.->|"collects results"| node_vuln_core
node_report_core -.->|"collects flows"| node_mitm_core
node_report_core -.->|"collects results"| node_dir_core

click node_entry "https://github.com/cirno-mira/net-ops-toolbox/blob/main/main.py"
click node_window "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/main_window.py"
click node_shared_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/widgets.py"
click node_logs "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/logging_bus.py"
click node_host "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/hostinfo.py"
click node_assets_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_assets.py"
click node_assets_core "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/assets.py"
click node_ports_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_ports.py"
click node_ports_core "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/ports.py"
click node_dir_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_dirbrute.py"
click node_dir_core "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/dirbrute.py"
click node_arp_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_arp.py"
click node_arp_core "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/arpmitm.py"
click node_dns_core "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/dnsspoof.py"
click node_mitm_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_mitm.py"
click node_mitm_core "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/mitm.py"
click node_capture_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_capture.py"
click node_capture_core "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/capture.py"
click node_vuln_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_vuln.py"
click node_vuln_core "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/vulncheck.py"
click node_report_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_report.py"
click node_report_core "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/report.py"
click node_hash_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_hash.py"
click node_hash_core "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/hashkit.py"
click node_tunnel_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_tunnel.py"
click node_tunnel_core "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/tunnel.py"
click node_fake_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_fakeserv.py"
click node_fake_core "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/fakeserv.py"
click node_tools_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_tools.py"
click node_tools_core "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/tools.py"
click node_diag_ui "https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_diag.py"
click node_netdiag "https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/netdiag.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_entry,node_window,node_shared_ui toneBlue
class node_assets_ui,node_assets_core,node_ports_ui,node_ports_core,node_dir_ui,node_dir_core toneAmber
class node_arp_ui,node_arp_core,node_dns_core,node_mitm_ui,node_mitm_core,node_tunnel_ui,node_tunnel_core,node_fake_ui,node_fake_core toneMint
class node_capture_ui,node_capture_core,node_vuln_ui,node_vuln_core,node_report_ui,node_report_core toneRose
class node_logs,node_host,node_hash_ui,node_hash_core,node_tools_ui,node_tools_core,node_diag_ui,node_netdiag,node_user toneIndigo
```

## Components

### Application interface

- [Application startup](https://github.com/cirno-mira/net-ops-toolbox/blob/main/main.py): `main.py`
- [Main window](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/main_window.py): `ui/main_window.py`
- [Shared UI widgets](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/widgets.py): `ui/widgets.py`

### Discovery and scanning

- [Asset discovery page](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_assets.py): `ui/tab_assets.py`
- [Asset discovery](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/assets.py): `core/assets.py`
- [Port scan page](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_ports.py): `ui/tab_ports.py`
- [Port scanning](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/ports.py): `core/ports.py`
- [Directory brute page](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_dirbrute.py): `ui/tab_dirbrute.py`
- [Directory brute force](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/dirbrute.py): `core/dirbrute.py`

### Traffic interception

- [ARP control page](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_arp.py): `ui/tab_arp.py`
- [ARP redirection](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/arpmitm.py): `core/arpmitm.py`
- [DNS redirection](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/dnsspoof.py): `core/dnsspoof.py`
- [Traffic interception page](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_mitm.py): `ui/tab_mitm.py`
- [Transparent proxy](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/mitm.py): `core/mitm.py`
- [Tunnel page](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_tunnel.py): `ui/tab_tunnel.py`
- [Port forwarding and shell](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/tunnel.py): `core/tunnel.py`
- [Fake services page](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_fakeserv.py): `ui/tab_fakeserv.py`
- [DNS and HTTP services](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/fakeserv.py): `core/fakeserv.py`

### Analysis and security

- [Packet capture page](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_capture.py): `ui/tab_capture.py`
- [Packet capture and streams](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/capture.py): `core/capture.py`
- [Security check page](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_vuln.py): `ui/tab_vuln.py`
- [Security probes](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/vulncheck.py): `core/vulncheck.py`
- [Report export page](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_report.py): `ui/tab_report.py`
- [Report generation](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/report.py): `core/report.py`

### Operations and support

- [Log bus](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/logging_bus.py): `core/logging_bus.py`
- [Host network info](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/hostinfo.py): `core/hostinfo.py`
- [Hash tools page](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_hash.py): `ui/tab_hash.py`
- [Hash and dictionary tools](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/hashkit.py): `core/hashkit.py`
- [Operations tools page](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_tools.py): `ui/tab_tools.py`
- [Operations utilities](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/tools.py): `core/tools.py`
- [Environment diagnostics page](https://github.com/cirno-mira/net-ops-toolbox/blob/main/ui/tab_diag.py): `ui/tab_diag.py`
- [Network diagnostics](https://github.com/cirno-mira/net-ops-toolbox/blob/main/core/netdiag.py): `core/netdiag.py`

### Other components

- **Operator**

## Connections

- Operator → Application startup: starts
- Application startup → Main window: opens (evidence: `main.py`)
- Main window → Asset discovery page: routes to (evidence: `ui/main_window.py`)
- Main window → Port scan page: routes to (evidence: `ui/main_window.py`)
- Main window → ARP control page: routes to (evidence: `ui/main_window.py`)
- Main window → Traffic interception page: routes to (evidence: `ui/main_window.py`)
- Main window → Packet capture page: routes to (evidence: `ui/main_window.py`)
- Main window → Directory brute page: routes to (evidence: `ui/main_window.py`)
- Main window → Security check page: routes to (evidence: `ui/main_window.py`)
- Main window → Report export page: routes to (evidence: `ui/main_window.py`)
- Main window → Hash tools page: routes to (evidence: `ui/main_window.py`)
- Main window → Tunnel page: routes to (evidence: `ui/main_window.py`)
- Main window → Fake services page: routes to (evidence: `ui/main_window.py`)
- Main window → Operations tools page: routes to (evidence: `ui/main_window.py`)
- Main window → Environment diagnostics page: routes to (evidence: `ui/main_window.py`)
- Asset discovery page → Asset discovery: runs scans (evidence: `ui/tab_assets.py`)
- Port scan page → Port scanning: runs scans (evidence: `ui/tab_ports.py`)
- Directory brute page → Directory brute force: runs probes (evidence: `ui/tab_dirbrute.py`)
- ARP control page → ARP redirection: controls (evidence: `ui/tab_arp.py`)
- ARP control page → DNS redirection: starts DNS (evidence: `ui/tab_arp.py`)
- ARP control page → Traffic interception page: requests proxy (evidence: `ui/main_window.py`)
- Traffic interception page → Transparent proxy: controls (evidence: `ui/tab_mitm.py`)
- Packet capture page → Packet capture and streams: captures packets (evidence: `ui/tab_capture.py`)
- Security check page → Security probes: runs checks (evidence: `ui/tab_vuln.py`)
- Report export page → Report generation: exports results
- Hash tools page → Hash and dictionary tools: runs tools (evidence: `ui/tab_hash.py`)
- Tunnel page → Port forwarding and shell: controls (evidence: `ui/tab_tunnel.py`)
- Fake services page → DNS and HTTP services: controls (evidence: `ui/tab_fakeserv.py`)
- Operations tools page → Operations utilities: runs utilities (evidence: `ui/tab_tools.py`)
- Environment diagnostics page → Network diagnostics: runs diagnostics
- Asset discovery → Port scanning: probes discovered hosts (evidence: `core/assets.py`)
- Asset discovery page → ARP control page: imports targets
- Log bus → Shared UI widgets: publishes messages (evidence: `ui/widgets.py`)
- Shared UI widgets → Main window: renders in (evidence: `ui/main_window.py`)
- Asset discovery page → Host network info: uses network info (evidence: `ui/tab_assets.py`)
- ARP redirection → Host network info: checks interfaces (evidence: `core/arpmitm.py`)
- ARP redirection → DNS redirection: coordinates redirection (evidence: `core/dnsspoof.py`)
- Transparent proxy → DNS and HTTP services: forwards optionally
- Report generation → Asset discovery: collects results
- Report generation → Port scanning: collects results
- Report generation → Security probes: collects results
- Report generation → Transparent proxy: collects flows
- Report generation → Directory brute force: collects results