Raspberry Pi-Based Framework for Network Security Threat Analysis in Local Area Networks

Abstract

The growing complexity of local area networks (LANs), along with restricted access to enterprise-grade monitoring systems, has made small-scale networks vulnerable to cyber threats like reconnaissance, denial-of-service (DoS) attacks, and unauthorised access. This paper describes the design and implementation of a lightweight, Raspberry Pi-based network threat analytics system that provides real-time monitoring and anomaly detection in LAN contexts. The system utilises open-source technologies, including Node-RED, Nmap, ifstat, hping3, and Netcat, to provide a multi-tab dashboard that displays active hosts, service availability, latency trends, and bandwidth usage. To simulate a realistic network environment, an isolated LAN was set up with a TP-Link AC1200 router and UMobile Home 5G connectivity. During the testing phase, the Raspberry Pi 400 operated as both a monitoring node and an attack simulator. Three attack scenarios, SYN Flood, TCP Port Scan, and Honeypot attack simulation, were used to test the system’s detection and visualisation skills. The system successfully identified volumetric traffic irregularities, reconnaissance activities, and interactions with misleading services while incurring minimum CPU and memory overhead. Evaluations of performance confirmed the system’s capacity to run on limited hardware while maintaining good responsiveness across all tabs within a single functional Node-RED dashboard. This study demonstrates the viability of installing low-cost, modular, and scalable network analytics solutions in resource-constrained situations such as home networks, educational labs, and small to medium-sized businesses. The suggested solution adheres to Zero Trust principles by requiring continuous verification of network operations and provides a practical foundation for improving situational awareness and early threat identification.