A small answer to a common home-network question
WatchYourLAN answers: what devices have appeared on this local network, and which of them are present now? It runs arp-scan on configured interfaces, stores results in SQLite or PostgreSQL, and presents hosts through a web interface. New-host notifications can go through Shoutrrr, while Prometheus or InfluxDB output supports longer Grafana views. Version 2.1.4 also includes an API, Swagger documentation, manual host creation, rescan triggers, bulk deletion, and Wake-on-LAN.
That is a sensible feature boundary. It is lighter than SNMP monitoring and friendlier than a cron job that mails raw scan output. You can name devices, see their recent presence, and notice an unfamiliar MAC address without maintaining a large observability platform. The MIT-licensed Go application is particularly well suited to a home server, router-adjacent Linux box, or small office utility host.
It is not an intrusion detection system. Seeing a MAC tells you that something answered ARP; it does not establish what software it runs, whether it is compromised, or whether a device hiding behind a router exists. Alerts are useful prompts to investigate, not security conclusions.
Setup is short but network-specific
The Docker example sets a timezone and one or more interface names, mounts /data/WatchYourLAN, and uses host network mode. The interface is then available on port 8840. Host networking is not an incidental convenience: ARP scanning needs access to the local link. A normal bridged container would mostly see its container network rather than the LAN you care about.
The project also publishes Debian, RPM, Alpine, and tar packages for x86, x86-64, several Arm generations, and Arm64. Native packages depend on arp-scan and tzdata. Configuration can live in the GUI, environment, or config_v2.yaml, with a default 120-second interval and 48 hours of retained history. SQLite is the easy default; PostgreSQL suits users already managing a database or needing external access patterns.
Choosing the correct interface is the first trap. On a physical Linux machine it might be enp4s0; in virtualized hosts, containers, Wi-Fi, bonds, bridges, and tagged VLANs produce less obvious choices. The VLAN guide supports multiple interfaces plus free-form arp-scan command strings. For example, a tagged subnet needs its CIDR, VLAN ID, and interface. This flexibility is useful, but errors become raw networking problems rather than friendly setup failures. Enable debug logging and inspect the actual command.
Local-link discovery has hard limits
ARP exists for IPv4 neighbors on the same link. Routers deliberately do not forward it, so WatchYourLAN cannot automatically inventory arbitrary remote subnets from one interface. You can attach it to several relevant interfaces or provide explicit VLAN scan strings, but the host must actually reach those layer-two segments. Open issue 141 reports that a configured second subnet was not discovered, illustrating why multi-subnet claims need testing against the real topology.
IPv6 uses Neighbor Discovery rather than ARP. Issue 202 asks why the application is IPv6-agnostic and remains open. A modern phone or server usually still has an IPv4 presence, but IPv6-only devices and address behavior are outside the tool's reliable view. Networks moving toward IPv6 should use Nmap, router data, or another scanner alongside it.
Device identity is also approximate. WatchYourLAN keys heavily on MAC addresses, but one address can represent several IPs in container or virtualization setups. Issue 92 says only one IP is displayed when Unraid containers share a MAC. At the other extreme, phones use private randomized MAC addresses, making one physical device appear as changing identities. Neither case fits a simple MAC-to-device table.
Vendor names come from the OUI database bundled with arp-scan. Issue 238 documents recent Apple prefixes showing as unknown because the packaged database lagged newer registries. A bind-mounted refreshed file is the reported workaround. Vendor text is helpful for recognition, but it should never be treated as authenticated device identity.
Protect the dashboard itself
WatchYourLAN has no built-in authentication. The README suggests Authelia or the author's ForAuth service and supplies a Compose example, then warns that host network mode still exposes the WatchYourLAN port. A reverse proxy login does not close direct access to port 8840. Bind or firewall it so only trusted clients or the proxy can connect. Do not publish it to the internet.
By default, the interface fetches themes, icons, and fonts from the internet. Fully local networks can run a separate node-bootstrap image and point WatchYourLAN at it. That adds a container, but avoids external page dependencies. Issue 234 reports the main container using hard-coded Google DNS instead of host or Kubernetes DNS, another concern for closed networks and split-horizon names.
Maintenance and project health
WatchYourLAN had 7,513 stars, 59 open issues and pull requests, and an MIT license when researched. The latest release, 2.1.4, and the last repository push both occurred September 10, 2025. Issues continued to receive reports and updates through August 2026, and a device-identity pull request was active in June, but there had been no main-branch push for roughly eleven months.
The existing release remains usable for its narrow job, and published packages make recovery easy. Still, assess open security and compatibility reports before exposing it, pin the container tag, back up the data directory, and do not assume feature requests will land quickly. The stale code date is not proof of abandonment because issue activity continues; it is a reason to keep the deployment simple and replaceable.
The practical choice
Use WatchYourLAN when you want a clean IPv4 presence list and new-device nudge for a small local network. It takes little time to evaluate, and its limitations are understandable. Put it on the relevant link, firewall the UI, label known devices, refresh vendor data if needed, and compare its list with your router.
Choose NetAlertX for richer discovery and publishing, Nmap for deeper and IPv6-aware scans, or LibreNMS for managed network equipment and operational monitoring. WatchYourLAN wins by staying small. It loses when users ask that small tool to cross routers, authenticate identities, inspect services, or prove security.