DEV Community: QuantumCat

The Polish Pass — I Rewrote My Three Beginner Scripts to Match the App They Became

QuantumCat — Thu, 15 Oct 2026 13:52:38 +0000

A few weeks ago I wrote about turning three beginner Python scripts — a connection monitor, a port scanner, and a snapshot reporter — into the QuantumCat SOC Toolkit, a desktop app with a real installer and a local AI analyst.

There was a loose end, and it itched.

The app had moved on. The GitHub repos hadn't. Anyone who clicked through from the toolkit to the original scripts still landed on the May 2026 versions: the monitor that didn't run, the scanner that couldn't say "closed," the process check that flagged "sync" for containing "nc." The repos are the front door to the whole project — they should show what the code learned, not just where it started.

So: a polish pass. All three scripts, upgraded to the same standard as the shipped toolkit. Same repos, same honesty rules.

The monitor: 57 lines → 373

The original net_watch.py polled ss -tun every 3 seconds and diffed the output. It also had a syntax error on line 19, tagged the local endpoint instead of the peer, and decided "private" by string prefix — which silently misses the entire 172.16.0.0/12 private range.

The rewrite:

Events are keyed on the peer endpoint — the address your machine is actually talking to, which is the only one a watcher cares about.
Real IP classification via the ipaddress module: full RFC1918 (10/8, 172.16/12, 192.168/16), loopback, link-local, IPv6 ULA, and CGNAT space (100.64/10) — the range that taught me a failing test is a gift.
Cross-platform collection with psutil, because Windows has no ss and the toolkit's users are mostly on Windows now.
A silent baseline on the first poll, so startup doesn't dump every existing connection on you as if it were news.
Proper structure: a ConnectionTracker that owns the diffing, a top-talkers count, and clean process name (pid) labels on events.

It went from "script I run in a terminal" to the actual engine the Monitor tab runs. Same job, done properly.

The port scanner: ~21 lines → 253

The original prompted for an IP and walked 11 ports one at a time with a 1-second timeout, printing only the open ones. A full sweep could take eleven seconds of pure waiting, and silence meant… something. Closed and filtered are different answers; the original couldn't give either.

The rewrite:

Threaded — 32 workers, so a sweep is a sweep, not a coffee break.
25 well-known ports with service names, because "443" means less to a learner than "443 — HTTPS."
Three distinct states: open, closed, filtered. All three get reported.
Optional --banner grab — reads what a service volunteers when you connect, nothing more. Passive, and labelled as such.
Input validation that explains itself instead of tracebacking at you.

Still standard library only. That was a rule from the start and it survived the rewrite.

The snapshot report: ~81 lines → 440

The original shelled out through os.popen and wrote a timestamped triage report. The soul was right — one file you can hand to a human — but the flagged-process check was a substring search, which is how "sync" ended up on a watchlist for containing the letters "nc."

The rewrite:

psutil-based sections throughout, with a computed connection summary instead of raw dumps.
The flagged-process check now compares exact process names against a short list of known dual-use tools (nc, ncat, socat, nmap, masscan, hydra, tcpdump, and friends). Exact match only. And it's still labelled in plain sight as the basic heuristic it is — a hint to go look, never a detection claim.
Every section degrades gracefully: if a data source isn't available, the report says "(unavailable)" and keeps going instead of dying halfway down the page.
Reports still land as timestamped files, same as the original — that part never needed fixing.

What I deliberately did not change

The git history.

The broken first commits are still there — the missing parenthesis, the misindented if, all of it. The new code sits on top as new commits, and the READMEs now tell both stories: what the script was in May 2026, and what the polish pass changed and why. Rewriting history to look like I knew what I was doing from day one would be a lie, and it would delete the most useful part for anyone learning behind me: the evidence that the embarrassing version is a normal place to start.

The READMEs got the same treatment as the code — rewritten to match what the scripts actually do now, bugs described in the past tense, "Updated" sections that say plainly what changed.

And yes, everything got tested before it got committed: the monitor catching a live loopback connection, the scanner against localhost with a real banner grab, the snapshot flagging an nc-named process on purpose. Lesson zero from the first article still runs the shop: run the thing you ship.

Why bother polishing free scripts?

Because the repos are where people decide whether the toolkit is worth twelve dollars. A front door that says "this code is broken and I never fixed it" argues against the app behind it. Now the free scripts and the paid app are the same standard of work — the app just adds the GUI, the analyst, and the installer.

If you're learning this stuff the way I did: keep your first versions. Commit the broken ones. Then, when you know more, go back and do the polish pass in public. The diff between who you were and who you're becoming is the best documentation you'll ever write.

I Turned Three Beginner Python Scripts Into a Windows Desktop App

QuantumCat — Thu, 15 Oct 2026 01:54:57 +0000

I Turned Three Beginner Python Scripts Into a Windows Desktop App

In May 2026 I was teaching myself cybersecurity the way a lot of people
do: tutorials, notes, and a vague feeling that I didn't actually
understand what my own computer was doing on the network. So I wrote
three small Python scripts to find out:

Network-Monitor (net_watch.py, 57 lines) — poll ss -tun every 3 seconds, diff against the last snapshot, print and log new connections, tag each peer LOCAL or EXTERNAL, keep a top-talkers count.
Port_scanner (~25 lines) — prompt for an IP, sequential connect_ex scan over 11 common ports with a 1-second timeout, print the open ones.
Snapshot-Report (~100 lines of os.popen) — write a timestamped triage report of the machine, plus a basic "suspicious process" check.

They were beginner scripts, and I mean that as a precise technical
description.

The embarrassing parts (which were the education)

The committed monitor didn't run. Line 19 is missing a closing
parenthesis, and an if further down is misindented. It sat on GitHub,
publicly broken, because I never ran the committed copy. Lesson zero
of shipping anything: run the thing you ship, from a clean checkout.

My monitor tagged the wrong endpoint. The script grabbed the first
IP-looking token on each line — the local endpoint, i.e. my own
machine, forever. What a watcher cares about is the peer. It also
classified "private" by string prefix (10., 192.168., 127.),
which silently misses the whole 172.16.0.0/12 private range — and
CPython's ipaddress module has opinions about CGNAT space
(100.64.0.0/10) that a failing test had to teach me.

My port scanner couldn't say "closed." Open ports printed;
everything else was silence. Closed (connection refused) and filtered
(timeout) are different answers, and a scanner that can't tell them
apart is only telling you a third of the story. It was also
sequential — up to a second per port of just… waiting.

My suspicious-process detector flagged "sync." The check was a
substring search of the ps aux output for names like nc. "Sync"
contains "nc". A name heuristic is a hint to go look; it is not
detection, and pretending otherwise sends you chasing ghosts.

The rebuild

I rewrote all three properly and combined them into one app, the
QuantumCat SOC Toolkit: a Tkinter GUI (stdlib only — no framework)
with five tabs — Monitor, Port Scanner, Snapshot Report, AI Analyst,
Settings/About.

The monitor parses ss output into structured records, classifies IPs properly, and keys events on the peer endpoint with clean process name (pid) labels. (On Windows, where there's no ss, it uses psutil with a netstat -ano parser as fallback.)
The scanner is threaded, covers 25 well-known ports with service names, reports open/closed/filtered as distinct states, and does an optional passive banner grab — it reads what a service volunteers, nothing more.
The snapshot report keeps the original's soul — one timestamped file you can hand to someone — but every section degrades to an "(unavailable)" line instead of crashing, and the flagged-process check compares actual process names, labelled in the app as the basic heuristic it is.
Everything is covered by test suites, because of lesson zero.

The local AI analyst

The fourth tab is the new idea. It collects what the other tabs found
and produces a plain-English assessment in a fixed template:

VERDICT: one line
What looks normal
What deserves a second look
Suggested next steps

It runs on a local model via Ollama — plain HTTP to localhost,
the only network destination in the app besides your own scans. A
security tool that phones your data home to a cloud AI would be a bad
joke, so there is no cloud anything: no accounts, no telemetry, no
analytics. And if you don't have Ollama, a built-in rule engine
produces the same template from the same findings, so the app works
out of the box either way. Ollama just writes smarter explanations.

The packaging lesson (the biggest one)

My first instinct was to ship the way my scripts lived: Linux, a
folder, run it from a terminal. Two problems. The actual user machine
was Windows. And "works if you know the incantation" is not
"works."

An earlier build proved it: extract a ZIP, the executable bit gets
dropped, and the file manager asks "open with what?" — dead on
arrival for a normal person. So the standard became a rule:

It should feel like installing Wireshark, not like adopting a
project. Double-click, install, desktop shortcut, click the cat,
app opens.

What shipped:

A real Windows .msi installer — per-user, no admin prompt, Desktop and Start Menu shortcuts with the cat icon, clean uninstall through Windows Settings.
A Linux .deb for the Debian/Ubuntu family and a portable .tar.gz (tar preserves the exec bits the ZIP lost).
The full Python source included in the download, for transparency and for anything the packaged builds don't cover.

No terminal gymnastics on either platform. The only add-on is Ollama,
and the included Start_Here guide walks through installing it and
pulling a model step by step.

Honest limits

This is a learning and triage tool built by a self-taught developer.
It is not a replacement for professional security software, and it is
not a packet analyzer — Wireshark is still king there. This toolkit's
job is watching, summarising, and explaining: what is my machine
talking to, what's listening on it, and what does that probably mean,
in words a person can act on.

DEV Community: QuantumCat

The Polish Pass — I Rewrote My Three Beginner Scripts to Match the App They Became

The monitor: 57 lines → 373

The port scanner: ~21 lines → 253

The snapshot report: ~81 lines → 440

What I deliberately did not change

Why bother polishing free scripts?

Links

I Turned Three Beginner Python Scripts Into a Windows Desktop App

I Turned Three Beginner Python Scripts Into a Windows Desktop App

The embarrassing parts (which were the education)

The rebuild

The local AI analyst

The packaging lesson (the biggest one)

Honest limits

Links