Per-host, per-app view of a network interface
Sniffnet is a desktop app that listens on one of your machine's network interfaces and shows, live, who it is talking to: remote hosts with their country, domain name and ASN, the service behind each connection and, since 1.5.0, the program generating the traffic. It runs on Windows, macOS and Linux, with a GUI written in Rust on the iced toolkit.
Bundled GeoLite2 data and alerts you can send to a webhook
- Country and ASN lookups stay local: MaxMind's GeoLite2 databases are compiled into the binary, and a custom MMDB file can replace them. Domain names come from reverse DNS.
- Filters at capture time and after: a BPF expression narrows the capture (since 1.4.1), then the Inspect page searches connections, with
!and!=to exclude a value. - Three alert triggers: a byte threshold, activity from a favorite, or an address on an imported IP blacklist (CIDR ranges since 1.5.1). Alerts can also be posted as JSON to a webhook.
- PCAP in and out: open a capture file in the GUI, or save the current session in the same format.
- Per-connection latency since 1.5.1, plus Linux's
anypseudo-interface to capture every interface at once.
Hunting a bandwidth hog or replaying a server capture
- Find the app eating a workstation's bandwidth in the program list on the Overview page.
- Get notified on screen, or in a bot or SIEM behind the webhook, when the machine reaches a blacklisted address.
- Load a PCAP file recorded on a headless server and browse it as charts.
Elevated capture rights and port-guessed service names
Capturing requires elevated privileges. On macOS the app runs as administrator. On Linux you either grant the binary cap_net_raw and cap_net_admin with setcap (the RPM package does it for you) or start it with sudo -E sniffnet, the only option for the AppImage. Windows needs Npcap in WinPcap-compatible mode. The project's threat model states that Sniffnet keeps those privileges after opening the capture handle.
Service names are looked up from port numbers. The "6000+ upper layer services, protocols, trojans, and worms" listed in the README come from nmap's port-to-service table. Sniffnet labels a connection by its ports, not by what the packets carry, so a connection to port 443 shows up as https whatever it actually transports.
No command-line flag runs Sniffnet without its GUI. The flags pick an interface at startup, print the config file path or restore default settings. The Linux-only Docker image needs --net=host, the NET_ADMIN and NET_RAW capabilities, and access to a Wayland or X11 display.
The project is aimed at non-specialists. Its website says most network analyzers "are difficult to understand" and calls being "usable with ease by everyone" one of Sniffnet's cornerstones.
Version 1.5.1, released July 22, 2026, is the latest, three months after 1.5.0. The main branch (last commit October 20, 2026) holds an unreleased IPFIX collector that receives traffic data from remote devices. The code is dual-licensed under MIT or Apache-2.0.
An external audit found a single low-severity issue, already fixed. Radically Open Security ran it under the Next Generation Internet program, and the project posted the results on April 13, 2025. The threat model in the repository lists protections not yet in place, including fuzzing the packet parser and rejecting http:// webhook URLs. Exported PCAP files are written to disk unencrypted.