Ilan LenznerAI developer · design engineer
Real-time network visualization

Internet traffic, as a galaxy

Every device on a network keeps asking the internet for directions, thousands of times a day. I built the router that sees every one of those requests, and a real-time 3D view that turns the traffic into light.

This is the real thing, running in your browser on a recorded day from my house. Drag the screen to turn it, and use the phone to switch between live and the last 24 hours.

How to read it

One request, one flight of light

The router

The bright core is the router. Every question passes through it, and the wire sphere around it is the ad blocker.

The devices

Each device on the network gets its own star on the inner sphere: computers up high, phones in the middle, TVs below, gadgets at the bottom.

The internet

The outer shell is where the questions go: Google, Apple, Netflix and the rest, each placed near the devices that use it most.

Blocked

An ad or a tracker flies in red and bursts on the shield. On this network that's about one request in three.

11,010DNS requests in one day
32%blocked before they left
28devices that asked
0bytes sent to a cloud to draw this

It started with a router

A board, eight antennas and a serial cable

The house router was a closed box I couldn't look inside. So I built one: a Banana Pi R3, flashed to OpenWrt over its serial console. It now blocks ads for the whole house, tells me on Telegram when a device I don't know joins, logs every internet outage, and backs itself up every Sunday.

Banana Pi R3 boxes, metal case, power supply and a serial cable on a table
The parts: the R3 board, its metal case, power and a USB serial cable.
The open case: eight antenna cables routed across the board to gold connectors
Eight antenna leads, routed by hand around the heatsink.
Three jumper wires on the board's GND, RX and TX pins, next to the boot switch table
Three wires on GND, RX and TX: the console I installed it through.
The closed black router with eight antennas, running on the desk
Closed up and running OpenWrt, AdGuard Home and Tailscale.

From logs to light

A log nobody reads, turned into something you watch

  1. RouterAdGuard Home on the R3 answers every DNS question in the house and keeps a log.
  2. Pi 5A small Python server reads that log, groups domains into brands and drops the router's own chatter.
  3. Screenthree.js draws each question as a flight from device to router to brand, at 60 frames a second on the Pi's own GPU.
  4. PhoneAn installable web app picks what the screen shows and names the devices.

Live, or the last 24 hours

Live shows the house right now. The replay plays the whole past day in a minute, with a comet on the outer ring marking the hour, so you see the house wake up, go quiet at night and come back in the morning.

Names that follow the device

Phones change addresses all the time, so names are stored on the router against the hardware address. Give a device a name in the phone app and it shows up on the screen, the router's dashboard and the Telegram alerts.

Where the AI comes in

Can a small local model explain the traffic to me?

The next step is a nightly summary in plain Hebrew: what happened, and three things worth checking. It has to run on the Pi, so none of this traffic leaves the network to be analysed. Before building it, I tested the idea on a real day of logs.

4B model

Fluent, and useless

It gave the same generic advice for every device and missed the one thing I had planted to catch it: a fake device talking to invented domains all night.

9B model

Actually useful

It flagged the planted device as unknown and possibly an intrusion, without inventing who owns it. It also found the busiest device in the house and its night-time habits.

The catch

Confidently wrong

Its top finding was "Netflix is blocked on a TV". It wasn't: only Netflix's logging was. My summary had folded every address into its domain, so the model never saw the difference.

What the model can know is limited to what you choose to show it. The fix wasn't a bigger model. It was a better summary.

Built with

Built with

The demo above runs on one recorded day. Device names are generic and addresses are made up; the timing, the brands and what got blocked are real.