Local IDS on Raspberry Pi uses a six-phase activity flow to detect network anomalies in real time without cloud dependencies. Live traffic capture via tcpdump feeds rotating 5MB .pcap chunks into concurrent file scanning, packet grouping by device ID, and sliding-window feature engineering that computes conn_count, bytes_sum, pkt_count, and avg_pkt_size. A quantized TFLite model runs inference on extracted features, generating anomaly scores that trigger JSON alerts logged with TimedRotatingFileHandler for midnight archival. This architecture demonstrates edge-based threat detection with minimal RAM footprint, race-condition safety, and autonomous operation ideal for IoT gateways and network monitoring appliances.