UniFi Broadcast Storm and MAC-Flap Monitor
The network diagnostic tool you write at 11 pm when the official dashboard says everything is fine.
UniFi's own interface shows devices and clients. It does not show per-port broadcast packets per second, spanning-tree state-change counters, or the same MAC address appearing on two ports ten seconds apart. Those are exactly the signals that precede a broadcast storm or expose a VLAN misconfiguration. This app polls the network from two angles at once, stores everything in SQLite, runs detectors over the deltas and renders a live dashboard with an annotatable timeline.
Why two data planes
The official API is good at inventory, CPU, memory and uptime. It does not expose port-level truth. So the fast loop runs mca-dump over SSH on the router, switches and access points and parses the counters out of it, while the slow loop uses the API for the things it is good at. The module docstring states this split explicitly.
Detectors
Every delta is clamped at zero so a counter reset after a reboot cannot masquerade as a spike, a bug most first drafts of this tool ship with. Broadcast packets per second are compared against separate warn and alarm thresholds for access ports and uplinks. A MAC seen on two or more ports inside ten seconds is a flap, with per-port rate thresholds. Four or more VLANs on a port looks like an access-point trunk and is informational; exactly two or three including the native VLAN on an otherwise quiet port is flagged as a probable mismatch. Spanning-tree churn and link flaps come off their own counters. An offline watcher counts consecutive ping failures before escalating so one dropped packet is not an incident.
Operational honesty
Some devices are deliberately excluded from SSH probing, and the comment explains why and what still covers them: the Flex Minis reject arbitrary command execution and one AP is powered down, but both remain visible through the API and through their upstream port's counters. The entry point pins the module search path because loose scripts in the parent directory would otherwise shadow standard-library modules, a real failure that was diagnosed and then structurally prevented.
Dashboard
A dark single-page view with per-device online dots, a per-port table colour-coded by severity, inline SVG sparklines with a dashed threshold line, and a scrolling alert feed. Syslog from the UniFi devices lands in the same alert table as the detectors.