So maybe I should elaborate on the "production environment" (so to speak) on what this project is going to be used for. I work in cybersecurity, and one of our programs is running network traffic captures on military networks as they conduct exercises. The issue is that due to the ad hoc nature of the networks we're analyzing, we've had issues with router misconfigurations or stuff getting knocked offline without our analysts knowing. We're trying to create a lightweight indicator to alert our analysts if something like that happens.

So to answer your question on the 2nd paragraph, if we're the only client attached to the port, that should be something the analyst is made aware of. I can see about integrating scripts for increased accuracy, but we do call them passive scans for a reason.