Developer simulates LAN attack on his own Mac and uncovers flaw in his security app

A developer used a ThinkPad running Arch Linux to simulate a rogue IoT device attacking his MacBook over a shared home network, with no special privileges or malware involved. An initial port scan revealed that while most ports were filtered, two development servers and macOS ControlCenter ports were still visible to the network. The experiment also exposed common developer mistakes such as binding services to 0.0.0.0 and leaving Redis or Docker ports unauthenticated on a LAN. During ARP spoofing tests, the developer discovered a gap in RoamSwitch, his own network-defense app, which relaxes firewall rules on trusted home networks, leaving ARP and open-port threats unblocked. The findings prompted him to decouple detection logic from protection levels in RoamSwitch, so monitoring runs continuously regardless of network trust status.