Find the shadow AI on your network
Drop in logs you already have — DNS, proxy, or a packet capture — and see every AI service being called from your network, by which machines, and how much data is leaving. Including the private LLM gateways nobody told you about, and the unattended agents that never sleep.
How to get your logs
Any one of these works. DNS or proxy/SNI logs from the network edge give the clearest picture.
Pi-hole / dnsmasq (easiest)
Pi-hole and dnsmasq log every DNS lookup. Grab the query log:
sudo cp /var/log/pihole/pihole.log ~/pihole.log # Pi-hole v6 # or older Pi-hole / plain dnsmasq: sudo cp /var/log/dnsmasq.log ~/dnsmasq.log
Drop that file above. Each query[A] host from 10.x.x.x line becomes a data point.
Squid proxy
Squid's access log carries the CONNECT host (SNI) for HTTPS:
sudo cp /var/log/squid/access.log ~/squid-access.log
Drop it above — native Squid format is auto-detected.
Zeek / Corelight
Use dns.log and/or ssl.log (TSV with the #fields header, or JSON):
cp /opt/zeek/logs/current/ssl.log ~/ssl.log cp /opt/zeek/logs/current/dns.log ~/dns.log
Drop either or both.
pfSense / OPNsense / other firewall
Export the DNS Resolver (Unbound) or proxy log, or any firewall log that records destination hostnames. The generic parser pulls hostnames + a client IP out of most exports — just drop the file and see what it finds.
Packet capture (Wireshark or tcpdump) — the richest input
A capture carries far more than hostnames. From a pcap the tool also recovers
upload volume per machine (the exfil signal), request cadence (machine-regular timing
flags an unattended agent, not a person), a JA4 client fingerprint (browser vs SDK vs Cursor
vs curl), QUIC / HTTP-3 SNI (decrypted from the Initial packet — any observer can, by design),
device names (learned passively from mDNS / DHCP), and the visibility gaps (DoH, DoT, ECH)
that would otherwise blind the audit. It still never decrypts application data. Both Wireshark's
.pcapng and tcpdump's .pcap work — no conversion.
sudo tcpdump -i any -w ~/capture.pcap -s 0 'port 53 or port 5353 or port 443 or port 853'
Use a full snap length (-s 0) so the TLS/QUIC handshakes aren't truncated — that's what
the JA4 fingerprint and QUIC SNI need. For the human-vs-agent cadence signal, capture for a few
hours, not seconds — a rotating ring buffer keeps the files small:
sudo tcpdump -i any -s 0 -G 3600 -w ~/ai-%H.pcap 'port 53 or port 5353 or port 443 or port 853'
Then drop one or more of the files above.