sniffnet is a free, open-source Rust application that lets authorized users comfortably monitor and inspect their own network traffic through an intuitive cross-platform GUI, from live charts to PCAP export.
| Tool | GyulyVGC/sniffnet — cross-platform GUI application to monitor and inspect network traffic |
| Category | Network traffic analysis / packet sniffer with graphical interface |
| Primary Use | Observing, filtering, and inspecting traffic on your own adapters, identifying services via nDPU-style heuristics, geolocating remote hosts, and exporting PCAP reports |
| Safe Use | Intended for monitoring networks you own or are explicitly authorized to analyze: home labs, enterprise defensive monitoring, and educational traffic analysis on consented hosts |
| Telemetry Note | Purely passive observation tool; it reads traffic rather than generating it, and leaves capture reports (PCAP exports) on the local machine. Promiscuous-mode captures on shared segments can expose third-party traffic to the operator. |
sniffnet positions itself as the friendly face of packet analysis: an application to comfortably monitor your network traffic, built in Rust and packaged for Windows, macOS, and Linux. With over 41,000 stars on GitHub, an Apache-2.0 license, and an active ROADMAP.md, it is one of the most visibly successful attempts to bring tcpdump-grade visibility to people who do not want to live in a terminal. The project's tagline — cross-platform, intuitive, reliable — is a fair summary of what the README emphasizes, and the breadth of its translation effort (25+ languages including Chinese, German, French, Russian, Portuguese, Spanish, Italian, and Polish) signals a deliberately broad audience beyond the usual English-speaking security crowd.
The architecture choices are worth noting for professionals evaluating supply-chain risk. The GUI is built on iced, a cross-platform Rust GUI library focused on simplicity and type-safety, rendering through wgpu by default. The troubleshooting section reveals a practical fallback: if graphical drivers misbehave on old architectures, setting ICED_BACKEND=tiny-skia switches to a CPU-only software renderer. This kind of escape hatch tells you the developers actually test on heterogeneous hardware, and the troubleshooting notes about glitchy interfaces and black icons read like battle scars from real-world GPU compatibility issues rather than boilerplate.
Functionally, sniffnet covers the full observation loop. You select a network adapter to inspect, apply a set of filters to the observed traffic, and then work through three main pages shown in the README's screenshots: an overview page with overall statistics, an inspect page for searching individual network connections in real time, and a notifications page where custom alerts fire when defined network events occur. The tool computes traffic intensity charts in real time, identifies which local programs are generating bandwidth, and lets you save favorite network hosts, services, and programs for recurring monitoring workflows.
Host attribution is where sniffnet gets genuinely interesting from a defensive perspective. It identifies the geographical location of remote hosts, and resolves their domain name and ASN, with IP geolocation and ASN data provided by MaxMind. Combined with local network identification — flagging connections that stay inside your LAN versus those that leave it — this gives an analyst a quick triage view of who a machine is actually talking to. The README also highlights recognition of 6000+ upper layer services, protocols, trojans, and worms, which is the classic nDPM/services-file style of port-to-application mapping, extended into a live monitoring context rather than a one-shot scan.
Capture persistence is handled through PCAP import and export. The README advertises comprehensive capture reports, meaning an analyst can export what sniffnet observed and hand it to Wireshark or another deep-dive tool for protocol-level dissection, or import existing captures for review within the same interface. For teams that already have an established capture pipeline, this makes sniffnet a viable front-end for initial triage rather than a walled garden — the standard format keeps it interoperable.
The notification system deserves its own paragraph because it changes the operational posture of the tool. Instead of passively watching charts, you can define network events — the README leaves the exact predicate vocabulary to the wiki — and receive desktop notifications when they occur. There is also thumbnail mode support, keeping an eye on your network even when the application is minimized. This pushes sniffnet toward continuous monitoring use cases: a lab operator watching for unexpected outbound connections, or a small-team defender wanting an ambient indicator of anomalous chatter without running a full SIEM.
Another defensively oriented feature is the ability to import custom IP blacklists to highlight potentially dangerous connections. This is a modest but practical enrichment mechanism: you bring your own threat intelligence — blocklists from your own research or trusted feeds — and sniffnet visually elevates matching traffic. It is not an inline blocking control; it highlights rather than prevents, which is the correct expectation to set. The tool is an observer, not an enforcement point.
Installation is unusually thorough for an open-source project. The README's download table covers Windows .msi installers for x64, arm64, and x86; macOS .dmg images for both Intel and Apple Silicon; and Linux packages across DEB, RPM, and AppImage formats spanning amd64, arm64, i386, and armhf architectures. Windows installers are code-signed through SignPath.io with a certificate from the SignPath Foundation, which materially reduces the risk of tampered binaries — a detail security teams should care about when vetting GUI tools for analyst workstations. The wiki documents alternative installation methods and required per-OS dependencies, the latter being the most common source of setup errors per the troubleshooting notes.
The project's sustainability picture is strong: sponsors include NLnet, CodeRabbit, IPinfo, and ADS.FUND, alongside individual backers, and the author actively solicits sponsorship to fund the roadmap. The existence of a public ROADMAP.md, a wiki described as a comprehensive manual with step-by-step guides, and a news feed at sniffnet.app all indicate maintained, documented software rather than an abandoned experiment. For a community tool that touches raw capture, that maintenance cadence matters as much as the feature list.
From a policy standpoint, sniffnet is squarely a monitoring and analysis tool, not an attack tool. Its legitimate home is on machines and networks you own or are explicitly authorized to observe: endpoint baselining in a lab, verifying what a piece of software actually phones home about, or continuous ambient monitoring of a home or small-office network. Because it passively captures traffic, operators should remember that running it on shared segments or capturing others' traffic without authorization carries the same legal weight as any other sniffer — the friendly GUI does not change the consent requirements. Reports and PCAP exports stored locally can also contain sensitive payload data, so retention handling applies.
Where sniffnet fits in a professional workflow is best understood as the approachable first layer of network visibility. It will not replace Wireshark for protocol dissection, Zeek for scripted network forensics, or an EDR for host telemetry — but for rapid, human-readable answers to what is my machine talking to, where is it geographically, on what services, and did anything anomalous just happen, it compresses a lot of that triage into a single cross-platform application. For junior analysts, it is also a genuinely good educational instrument: watching live charts and service attribution build intuition in a way that scrolling tcpdump output does not.
GyulyVGC/sniffnet.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.