winsec-tools

Lightweight Windows security stack health checker and LAN scanner. Pure Python, zero dependencies.

Born out of frustration: every component in a multi-layer Windows security stack can be running without actually working. These tools check that your defences are genuinely active, not just consuming RAM.

Tools

secsweep.py — Security Stack Health Check

Verifies that each layer of your network defence stack is not just running, but actively filtering. Designed to catch silent failures — services that start on boot but have protection toggled off, corrupt databases, missing kernel drivers.

Checks performed:

• Portmaster — Service, WFP kernel driver loaded, DNS interception on port 53, filter intel freshness, upstream DNS configured
• AdGuard — Service + GUI + browser extension, zombie detection (parses logs for "protection off" signatures), WFP TCP listener count
• ProtonVPN — Client, service, tunnel process (OpenVPN/WireGuard), TUN adapter status, VPN DNS assignment
• GlassWire — Service, GUI, database corruption detection (flags DBs under 1KB)
• Windows Firewall — All three profiles (Domain/Private/Public) verified enabled

python secsweep.py           # Full colour dashboard
python secsweep.py --quiet   # Only show problems
python secsweep.py --json    # Machine-readable output

netscan.py — LAN Device Scanner

Pure Python LAN scanner — no nmap, no scapy, no extra dependencies. Ping sweeps your subnet, reads the ARP table, resolves hostnames, and looks up MAC vendor prefixes. Replaces GlassWire's Network Scanner (which breaks when VPNs are active).

Features:

• Parallel ping sweep (50 threads, ~30 second full /24 scan)
• MAC vendor identification via OUI prefix lookup
• Hostname resolution
• Multi-IP device detection (flags devices claiming multiple IPs)
• Known device tracking with new device alerts
• Gateway and self-identification

python netscan.py            # One-shot scan
python netscan.py --json     # Machine-readable output
python netscan.py --watch    # Rescan every 60s, alert on new devices

Requirements

• Windows 10/11 (uses PowerShell cmdlets for system interrogation)
• Python 3.10+ (pure stdlib — no pip install needed)
• The security tools you want to monitor (Portmaster, AdGuard, etc.) — secsweep gracefully reports missing components

Installation

git clone https://github.com/ash23x/winsec-tools.git
cd winsec-tools
python secsweep.py

That's it. No virtual environments, no requirements.txt, no Docker. Just Python and your Windows box.

Customising secsweep

secsweep is modular — each component check is a standalone function. If you don't run Portmaster or use a different VPN, just comment out or modify the relevant sweep_* function. The pattern is simple:

1. Check process is running
2. Check service is registered and started
3. Check the component is actually doing its job (kernel driver loaded, ports bound, logs show active filtering)
4. Return ACTIVE, DEGRADED, ZOMBIE, or DEAD

The ZOMBIE state is the key insight: a service that's running but not protecting you. This is the silent failure mode that costs you security without any visible warning.

Why not Docker?

These tools interrogate the Windows host directly — WFP drivers, service states, firewall profiles, ARP tables. Putting them in a Docker container would isolate them from everything they need to inspect. They must run on bare metal.

Contributing

PRs welcome. If you run a different security stack (Simplewall, WireGuard standalone, Mullvad, etc.) and want to add a sweep function, the pattern is documented in each existing checker.

License

MIT — do whatever you want with it.

Author

Built by ash23x — network security tooling from Ontos Labs.