Encountered Issues & Real-World Challenges
Auditing modern networks involves overcoming aggressive hardware constraints, vendor privacy safeguards, and operating system variances. Here is an overview of the technical hurdles encountered during Cerberus development and how they were solved.
1. Router & Device Speed Limits
1. Router Packet Processing & Port Scan Throttling
Encountered ChallengeHigh-speed port sweeps (e.g. 5,000+ packets/sec) cause home and small-office routers to overheat, drop packets, or disconnect other Wi-Fi devices.
Cause: Consumer routers possess limited CPU and small NAT state tables. When flooded with SYN packets, state tables fill up, dropping legitimate traffic.
Engineered a Tri-Stage Hybrid pipeline: Stage 1 ARP mapping bounds packet bursts, and RustScan uses adaptive batching to find open ports before Nmap audits them.
Outcome: Eliminated router lockups while increasing full-port audit speed by 60x.
Cerberus serializes scan work through scanGate, preventing network packet storms.
2. Router Variances & mDNS Filtering
2. Router mDNS / Multicast Isolation
Encountered ChallengeMany Wi-Fi routers disable multicast forwarding (mDNS / SSDP) between Wi-Fi bands (2.4 GHz vs 5 GHz) or between Ethernet and Wi-Fi.
Cause: mDNS relies on 224.0.0.251 / UDP 5353 multicast, which some routers drop to reduce wireless broadcast traffic.
Multi-channel fallback: if mDNS fails, Cerberus queries the router gateway directly via reverse DNS (PTR), checks NetBIOS (UDP 137), and parses UPnP descriptors.
Outcome: Ensures accurate hostnames even on strict commercial or segmented Wi-Fi networks.
3. Mobile Device Sleep Modes & Power Saving
3. Sleeping Mobile Devices (Power-Saving ARP Offload)
Encountered ChallengeSmartphones locked in sleep mode appear as 'dead' hosts to port scanners because all TCP listening ports are shut down.
Cause: iOS and Android power management halts user-space services. The low-power Wi-Fi chip answers ARP queries on behalf of the sleeping main CPU.
Created the Sleeping Mobile Heuristic Classifier in internal/identity/resolver.go. When a device answers Stage 1 ARP with a randomized MAC but has 0 open ports, Cerberus classifies it as a sleeping smartphone.
Outcome: Device stays online on the dashboard instead of flapping between 'up' and 'down'.
4. Vendor Security Measures & MAC Randomization
4. Private Wi-Fi Addresses & MAC Randomization
Encountered ChallengeApple iOS 14+, Android 10+, and Windows 11 randomize their MAC addresses by default, creating duplicate device entries on every scan.
Cause: Operating systems mask their factory hardware MAC addresses with synthetic Locally Administered Addresses (LAA) for privacy.
Implemented 3-Tier Identity Matching (internal/identity/matcher.go). Inspects the LAA bit (Byte 0, Bit 1 == 1) and utilizes persistent per-SSID MACs, NetBIOS names, and port fingerprint hashes to link sessions.
Outcome: Preserves continuous device timeline histories without creating duplicate ghosts.
5. Heterogeneous Operating System Stacks
5. Different Networking Stacks on Linux, macOS, and Windows
Encountered ChallengeLink-layer raw packet capture, ARP cache reading, and privileged execution require completely different APIs on every operating system.
Cause: Linux uses Netlink sockets and Linux capabilities; macOS uses BSD sysctl routing dumps and SMJobBless LaunchDaemons; Windows requires Npcap and IP Helper APIs.
Built a clean platform abstraction layer (internal/platform/) with dedicated native implementations for Darwin, Linux, and Windows.
Outcome: Consistent, cross-platform behavior across all supported desktop operating systems.