Meerkat — Keeps an Eye on Your Network So You Don’t Have To
Sometimes the network’s quiet — too quiet. Then a device pops up where it shouldn’t be. Or someone plugs in a rogue switch. Or a new MAC address starts scanning half the subnet. That’s the moment Meerkat was built for.
It watches. Not with noise, not with graphs — just presence. Devices come and go, traffic flows shift, and Meerkat keeps track. Not trying to replace your NMS. Just quietly filling in the gaps between pings and port scans.
It’s small. It’s observant. And it notices things others overlook.
What It’s Good At (Not Just What It “Has”)
| Functionality | Why That Matters |
| Passive Device Monitoring | Detects new or disappearing devices on the LAN — no scans required. |
| MAC & Vendor Awareness | Identifies devices by manufacturer — helpful for spotting outliers fast. |
| Silent Surveillance Mode | Doesn’t interfere with traffic. Just watches ARP, DHCP, broadcasts, etc. |
| Subnet Watchlists | Focuses on what matters: production VLANs, Wi-Fi guest zones, DMZs. |
| Instant Alerts | Triggers when something odd appears — not when something obvious breaks. |
| Lightweight by Design | Can run on a Raspberry Pi, a laptop, or a VM with minimal resources. |
| No External Dependencies | Doesn’t need cloud, agents, or logins. Local, fast, and self-contained. |
Where It Belongs
Not every environment needs Meerkat. But the ones with quiet surprises — those do.
It’s a great fit when:
– No one’s watching the guest Wi-Fi segment, and things keep “appearing.”
– Devices get swapped without change control.
– There’s a policy against unmanaged hardware — but no way to enforce it.
– OT networks need passive visibility without touching a thing.
– You want a second opinion before someone says, “we were never told that was there.”
In short: it gives visibility in places most tools gloss over.
How It Gets Going (Spoiler: Pretty Quickly)
- Download It
Go to the project page (usually GitHub or the vendor site) and grab the latest stable release for your system.2. Deploy It Where It Can See
Best on a trunk port, SPAN/mirror, or anywhere it gets a full view of one or more subnets. Doesn’t need root — just permissions to listen.3. Let It Observe
It’ll start building a table of who’s there, what interfaces they talk from, and how often they show up.4. Set Up Alerts (Optional)
Define what’s considered “unexpected.” A new MAC vendor? A device outside the allowed IP pool? Let it ping you quietly when that happens.5. Review When You Need To
Dashboard is minimal — just the facts. No pie charts. No fluff. Just “seen,” “gone,” and “why does that look unfamiliar?”
Final Notes
Meerkat isn’t trying to take over your monitoring stack. It won’t chart CPU load or give you SNMP stats. What it will do is whisper, “that thing wasn’t here yesterday,” at just the right time.
It’s made for the moments between events — the space where trouble quietly creeps in. And it’s a relief to have something watching, even when no one’s looking.
