Cerberus: Guarding Your LAN When Users Walk Straight Into Internet Security Holes

You can spend three weeks configuring strict VLAN isolation, 802.1X authentication, and enterprise-grade firewall rules. You can lock down every port, block every suspicious domain, and write a 40-page security compliance handbook.

And yet, within twenty minutes of going live, a user will plug in a “smart toaster” with 2012 firmware, click a blinking banner ad promising “Free RAM Download (100% Legit)”, and walk your entire network straight into every security hole known to modern computing.

The Human Factor: Walking Past Every Guardrail

#

Network administration in the real world is less about stopping sophisticated APT state actors and more about stopping Dave from Accounting from running .exe files he received in a surprise invoice email.

When users treat your network perimeter like an open-air farmers market for malware, traditional user-space packet sniffers can get bogged down, miss fast-moving bursts, or demand bloated runtime setups.

You need something that sits right at the kernel boundary—a vigilant guardian that watches every single packet before userspace even knows what hit it.

Enter Cerberus: The Kernel-Level Network Guardian

#

Named after Hades’ mythical three-headed hound, Cerberus is an open-source, high-performance network monitoring tool built with eBPF (Extended Berkeley Packet Filter) in Pure Go.

Instead of waiting for packets to travel up the heavy networking stack, Cerberus attaches directly to the Traffic Control (TC) ingress hook inside the Linux kernel. It captures, inspects, and analyzes network traffic at lightspeed.

Why Cerberus Beats Traditional Monitors

#

Core Capabilities at a Glance

#

• Kernel-Level Packet Inspection: Hooks into ARP, TCP, UDP, ICMP, DNS, HTTP, and TLS traffic in real time without dropping packets.
• Automatic Device Discovery: Instantly detects new devices joining your subnet and identifies manufacturers via IEEE OUI database lookups.
• Layer 7 Deep Inspection: Parses DNS query domains, HTTP request headers, and TLS handshakes to reveal what your “smart” appliances are really talking to.
• Smart Deduplication & LRU Caching: Uses intelligent pattern tracking so you only get alerted when a genuinely new or anomalous traffic pattern emerges.
• Behavioral Anomaly & Threat Signals: Detects SYN-heavy connection bursts, port sweeps, and high-volume traffic spikes associated with port scans or rogue device floods.

The Cerberus Control Room: Order Amidst the Chaos

#

Cerberus features a hash-routed, single-page web dashboard (Control Room) that provides live visibility into your entire network without overwhelming you with noise:

┌──────────────────────────────────────────────────────────────────────────┐
│ Network Guardian                                                         │
│ Cerberus Control Room                              [ Dark mode ]        │
├──────────────────────────────────────────────────────────────────────────┤
│ Overview │ All devices │ Rule alerts │ Anomalies │ Raw JSON              │
├──────────────────────────────────────────────────────────────────────────┤
│ ┌─ Route: #/ (Overview) ───────────────────────────────────────────────┐ │
│ │ ┌─────────────────────┐ ┌─────────────────────┐                      │ │
│ │ │ Live summary        │ │ Recent devices      │                      │ │
│ │ │ (packet counters)   │ │ (links → device)    │                      │ │
│ │ └─────────────────────┘ └─────────────────────┘                      │ │
│ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐                    │ │
│ │ │ Top services │ │ Top vendors  │ │ DNS ranks    │                    │ │
│ │ └──────────────┘ └──────────────┘ └──────────────┘                    │ │
│ │ ┌──────────────────────────────────────────────────────────┐         │ │
│ │ │ Anomaly detection (status, metrics, recent alerts)       │         │ │
│ │ └──────────────────────────────────────────────────────────┘         │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────────────┘

When Dave plugs in his sketchy smart mug, Cerberus doesn’t panic. It logs the MAC, identifies the vendor, inspects the outbound TLS handshake, and flags any unusual port activity—all while using minimal CPU overhead.

Quickstart: Deploying Cerberus on Your Host

#

Requirements: Linux kernel 5.10+ with eBPF enabled, Go 1.26+, and root/sudo privileges.

# Clone the repository
git clone https://github.com/zrougamed/cerberus.git
cd cerberus

# Download dependencies & build binary
go mod download
make

# Unleash the three-headed guardian
sudo ./build/cerberus

Once running, pop open your browser to the Control Room endpoint and sit back with a hot cup of coffee while eBPF does the heavy lifting.

Final Thoughts: Embrace the Calm

#

You can’t change human nature, and you certainly can’t prevent users from attempting to download more RAM. But with Cerberus running in kernel space, you don’t have to live in fear of your own LAN.

What’s the Worst Device on Your LAN?

#

What is the single most terrifying device or user mistake you’ve ever uncovered on your local network? A rogue crypto miner on a smart TV? An unpatched NAS exposed to port 80? Drop your funniest network horror stories in the comments below!