How jermsmit/whats-scanning-me works
What's Scanning Me? is a lightweight Flask honeypot: it listens on configured attack ports, records connection attempts, and presents threat summaries and controls in a web dashboard. The main flow is incoming TCP/selected UDP traffic → event enrichment and logging → dashboard statistics or JSON export; operators can also change monitored ports through the UI. Source excerpts show the listener, event, storage, and route behavior in app.py. The README documents additional dashboard summaries and persistence; unsampled details are represented only where that documentation supports them.
Main entry points: app.py Event enrichment · dashboard.html Live dashboard · ports.html Port controls
Components 17
Traffic Capture
- TCP listener
app.py - UDP listener
app.py - Listener control
app.py
Event Records
- Event enrichment
app.py - In-memory events
app.py - Persistent scan log
app.py
Dashboard and API
- Dashboard route
app.py - Threat statistics
app.py - Live dashboard
templates/dashboard.html - JSON export
app.py
Monitoring Controls
- Port configuration
app.py - Port management route
app.py - Port controls
templates/ports.html
Other components
- Remote scanner
- Hostname resolver
- Operator
- Web browser
Connections 23
- Remote scanner → TCP listener: connects TCP
- Remote scanner → UDP listener: sends UDP
- TCP listener → Event enrichment: dispatches event
- UDP listener → Event enrichment: dispatches event
- Event enrichment → Hostname resolver: resolves hostname
- Event enrichment → Port configuration: reads service config
- Event enrichment → In-memory events: updates events
- Event enrichment → Persistent scan log: appends record
- Persistent scan log → In-memory events: loads history
- Listener control → Port configuration: reads ports
- Listener control → TCP listener: starts listener
- Listener control → UDP listener: starts listener
- Web browser → Dashboard route: requests page
- Dashboard route → Live dashboard: renders page
- Live dashboard → Threat statistics: polls summaries
- Threat statistics → In-memory events: reads events
- Web browser → Port management route: submits changes
- Port management route → Port controls: renders controls
- Port management route → Port configuration: saves ports
- Port management route → Listener control: changes listener
- Web browser → JSON export: requests export
- JSON export → In-memory events: reads events
- Operator → Web browser: views dashboard