today i wrote a thing for that tabletop im doing next week.
its just a tcpdump parser, but its functionally an inventory/asset discovery tool. it builds a list of discovered hosts and nabs additional packets from them that leaks what they are and what they do.
the endpoint its running on is a gl.inet slate-ax. inside of 30 seconds its told me more about the lan than nmap could in ten times as long.
im blown away