See Your Scanners

LightScope is a lightweight, open-source network security monitor that transforms closed ports into honeypots. See who's scanning your systems without dedicated infrastructure.

Provided by USC Information Sciences Institute.

• Monitors closed ports for attacker connections
• Runs honeypot services to observe attack patterns
• Reports attackers to AbuseIPDB and ISPs
• Generates personalized IP blocklists
• Provides a web dashboard at thelightscope.com

LightScope is not antivirus or EDR. It won't slow down your system or interfere with your applications. It observes network traffic passively and runs lightweight honeypot services on ports you're not using.

Servers: See who's targeting your infrastructure. Get automatic ISP abuse reporting.

Home/Laptop: Detect compromised routers or IoT devices on your network. Identify threats on public WiFi.

curl -O https://thelightscope.com/latest/lightscope_latest.deb
sudo dpkg -i lightscope_latest.deb

curl -O https://thelightscope.com/latest/lightscope_latest.rpm
sudo rpm -i lightscope_latest.rpm

Download from Releases and run the installer.

curl -fsSL https://raw.githubusercontent.com/thelightscope/lightscope/main/install-lightscope-container.sh | bash

Download the installer from Releases and run as Administrator.

# Build the plugin
cd /usr/plugins/security/lightscope
make package

# Install
pkg install work/pkg/os-lightscope-1.0.pkg

# Start
service os-lightscope onestart

See OPNsense/README.md for detailed instructions.

• Packet capture and traffic analysis
• Honeypot services on configurable ports
• Automatic detection of unwanted connections
• Secure auto-updates with signature verification
• Runs as a system service (systemd, launchd, Windows Service)
• Web dashboard for monitoring

LightScope anonymizes all data before transmission:

• Internal IP addresses are randomized
• No personally identifiable information is collected
• Anonymization methods are IRB-approved (study UP-25-00124)

• Installation
  • Linux (dpkg)
  • macOS
  • Windows
  • Container
  • OPNsense
• Container Quick Start
• Building Packages
• Deployment
• Firewall Configuration

After installation, edit the config file:

• Linux: /opt/lightscope/config/config.ini
• macOS: /Applications/LightScope.app/Contents/Resources/config/config.ini
• Windows: C:\Program Files\LightScope\config\config.ini
• Container: /opt/lightscope-container/config/config.ini
• OPNsense: /usr/local/etc/lightscope.conf

See CONTRIBUTING.md for guidelines.

MIT License. See LICENSE for details.

• Website: https://thelightscope.com
• Issues: https://github.com/Thelightscope/thelightscope/issues
• Email: e@alumni.usc.edu