NETOUTPOST / GETTING STARTED

Get started with NetOutpost

Start on a home, lab or small-business network you own or manage. Get a clear view of its devices, then decide which signals you want to hear about.

On a Mac

1. Check Apple menu → About This Mac. An M-series chip uses Apple Silicon; an Intel processor uses the Intel build.
2. Choose your download. The disk image contains NetOutpost and an Applications shortcut. Apple Silicon requires macOS 13 or later; Intel requires macOS 13 or later.
3. Open the DMG, drag NetOutpost.app onto Applications, then open NetOutpost from Applications. The dashboard opens in its own native window and starts background monitoring.
4. This developer preview is Developer ID signed and Apple notarized. Its notarization ticket is stapled to the app for offline Gatekeeper verification.

On Linux

1. Choose x86-64 for most Intel/AMD PCs, or ARM64 for a 64-bit ARM system. Desktop packages target Ubuntu and Debian.
2. Open the Debian package with your distribution’s software installer. It includes the service, dashboard, desktop launcher and login autostart entry.
3. Launch NetOutpost from your applications menu. It uses a browser app window when available, or your default browser.

On Linux, ports below 1024 require binding-helper setup. A higher port can be used when needed; traffic sent to a protocol’s standard port reaches only a listener on that port.

Updating an existing installation

Your settings and history are kept when you update. Keep your existing application data folder.

On Mac, use NetOutpost → Check for Updates for future updates. To move from a version earlier than 0.1.43, stop monitoring and quit the old app before replacing it from the DMG. Keep your application data to preserve settings and history. On Linux, use Settings → System → Application updates. For Linux versions earlier than 0.1.33, install the current download manually.

Make it your network

1. Select the right interface. Review the home, lab or workplace network and approve the one you intend to monitor.
2. Review decoys. Eligible bundled decoys are selected by default. Resolve port conflicts and check which listeners are actually running.
3. Set your alert threshold. Start with Moderate for authentication and more deliberate interactions. Choose Info to also include newly discovered open ports.
4. Allow desktop notifications. Open Settings → Notifications. Use the labeled test-alert action to check that a notification opens its incident.
5. Choose your privacy settings. Review the sharing options during setup. You can keep sharing disabled; evidence is stored on your computer.
6. Build your first inventory. Accept the setup scan to find devices and services without generating alerts. Open Explore to review what was found and give devices useful names.

Explore your devices. Watch with decoys.

Explore checks real devices for open services. Choose a network, known devices or one IP, then review service details, risk indicators and recommended actions. The optional external perimeter scan shows which services are exposed on your public IP address. Later checks update the inventory and device address history.

Decoys run emulated services on the NetOutpost computer. They respond to incoming connections and record sign-in attempts and commands in isolated sessions. They continue listening independently of your Explore scans.

Alerts brings the observations together. Discovery reports new or reopened ports at Info level; decoy interactions range from Low to High. Open an alert for the source device, evidence and recommended action.

Keep monitoring available

You can close the dashboard while the independent service continues. Keep the computer awake and connected. Sleep, shutdown and a paused service create coverage gaps. On Mac, open NetOutpost → Background Access to enable monitoring at login and approve standard-port access. macOS may ask you to allow NetOutpost background items in System Settings. Use NetOutpost → Uninstall to remove the app’s background services. Linux desktop packages include a login autostart entry.

Network-change protection can pause decoys after a gateway change. Review the new network in Settings before adopting it as an approved home, lab or workplace network. Local administration stays on localhost unless you explicitly enable remote management.

Linux portable builds

Extract the portable archive and enter its netoutpost-0.1.45-linux-ARCH folder. Run ./first-run.sh as your regular account for guided command-line setup, or ./netoutpost-dashboard for desktop use. The folder includes a README, Linux setup guide and PRIVILEGED-PORTS.md with instructions for ports below 1024. Over SSH, use an interactive terminal with ssh -t. Keep the extracted folder in a permanent location.

Choose a download ↓