Sniffnet

A desktop app that lists your computer's network traffic by remote country, domain, and program. It does not show packet contents.

View on GitHub(opens in a new tab)Official site(opens in a new tab)
cat sniffnet/meta.ymlChecked on 2026-10-25

Safety

Impact Reaches othersSees other people's traffic or sends traffic to their devices
Admin rights
Required
Test lab
Not required

Usage

Purpose
Defense
Difficulty
Beginner
Type
Desktop app
Platforms
Windows / macOS / Linux

Trust

Repository
gyulyvgc/sniffnet
License
Check termsMIT OR Apache-2.0
GitHub
stars41,6912026-10-25
Maintenance
Actively updatedLast update 2026-10-21
CategoryNetworkDefense and hardening
Contents
  1. Introduction
  2. What Sniffnet does
  3. Connections it makes
  4. Try it safely on your own computer
  5. Common tasks
  6. How it differs from Wireshark
  7. Cautions
  8. Read next
  9. Sources

Sniffnet shows you who your computer talks to, which programs do the talking, and how much data moves. You work with buttons and lists, so you don’t need to learn any commands.

This review is for people who want to take a first look at their own computer’s traffic. After reading it, you can do the following:

  • Install Sniffnet and watch traffic on your own network adapter
  • Find the hosts and programs that use the most data
  • Get a notification when a condition you set is met

What Sniffnet does

The official README and wiki list these main features:

  • List each remote host with its country (as a flag), domain name, AS name (the organization that runs its network), and amount of data
  • Show the name, icon, and data usage of each program that uses the network
  • Draw real-time charts of traffic volume
  • Recognize more than 6,000 services and protocols
  • Notify you when traffic per second passes a threshold, when a favorite host exchanges data, or when a blacklisted IP exchanges data
  • Export captured traffic as a PCAP file, and import saved .pcap, .pcapng, and .cap files
What it doesn’t doYou cannot view packet payloads inside Sniffnet. The FAQ suggests exporting a PCAP file and opening it in Wireshark if you need them. Sniffnet also cannot block traffic. The filters on the first screen only change what the app displays, not what the adapter receives.

Connections it makes

Sniffnet looks up countries and AS names in MaxMind GeoLite2 databases (the free version) built into the app, so it does not send each IP address to an outside service. It does make these outside connections:

  • Reverse DNS lookups to show domain names
  • A check for a newer release. The source code queries the GitHub API
  • Remote notifications, if you turn them on. Sniffnet sends each notification as JSON in an HTTP POST to the URL you set

Try it safely on your own computer

Only use Sniffnet on your own computer and on networks you manage.

  1. Download the package for your operating system from the official download page or GitHub Releases.
  2. Set up your operating system as shown in the table below.
  3. Start Sniffnet and pick a network adapter on the left side of the first screen. By default, Sniffnet selects the adapter your system marks as the main one.
  4. Start the capture. Remote hosts and programs appear in lists. You can sort them by last-seen time or by amount of data.
OS Setup
Windows Install Npcap and check “Install Npcap in WinPcap API-compatible Mode” during installation. The last page of the Sniffnet installer has a checkbox that opens the Npcap website
macOS No extra software is needed. Run the app with administrator privileges
Linux Install libpcap and the other listed packages. If you don’t run as root, set capabilities on the executable (for example, sudo setcap cap_net_raw,cap_net_admin=eip <your/Sniffnet/executable/path>). The AppImage must run with sudo, for example sudo -E sniffnet

The wiki page “Alternative installation methods” covers Homebrew (brew install sniffnet), Scoop, cargo install sniffnet --locked, a Docker image for Linux, and more.

Common tasks

To do this Do this
Watch only some traffic Type a BPF (Berkeley Packet Filter) expression in the filter field on the first screen
Keep an eye on a host Click the star icon on a host or program to mark it as a favorite
Notice traffic spikes In the Notifications tab of the settings, set a threshold in bits, bytes, or packets and turn the notification on. All notifications are off by default
Notice traffic with suspicious IPs In the General tab of the settings, import a blacklist file with one IP address or CIDR range per line
Investigate later Check the PCAP export box on the first screen. The default file name is sniffnet.pcap, saved in your home directory

How it differs from Wireshark

The Sniffnet FAQ describes Sniffnet as lighter and easier to use than Wireshark, and says Wireshark has far more features.

Sniffnet Wireshark
What you see Data per host and per program, country, domain Each packet’s contents, layer by layer
Packet payloads Not shown in the app Readable
PCAP files Can export and import Opens them for detailed reading

You can use both: get the big picture in Sniffnet, export the traffic you care about as PCAP, and read it in Wireshark.

Cautions

  • Do not watch other people’s traffic without permission from them or the network’s administrator. On a shared computer or a work network, ask the administrator first.
  • Exported PCAP files store traffic, including payloads, unencrypted. The project’s threat model points this out. Check the contents before you share a file.
  • PCAP export writes as much data as passes through the adapter. The wiki warns that this can fill your disk quickly, so turn it on only when you need it.
  • Remote notifications send details such as host countries and domains to the URL you set. Only use an endpoint you control.

Sources

  1. Official repository (README)github.com/GyulyVGC/sniffnet
  2. Cargo.toml (license field)github.com/GyulyVGC/sniffnet/blob/main/Cargo.toml
  3. Wiki: Required dependenciesgithub.com/GyulyVGC/sniffnet/wiki/Required-dependencies
  4. Wiki: Install on Windowsgithub.com/GyulyVGC/sniffnet/wiki/Install-on-Windows
  5. Wiki: Alternative installation methodsgithub.com/GyulyVGC/sniffnet/wiki/Alternative-installation-methods
  6. Wiki: Data source selectiongithub.com/GyulyVGC/sniffnet/wiki/Data-source-selection
  7. Wiki: Filters configurationgithub.com/GyulyVGC/sniffnet/wiki/Filters-configuration
  8. Wiki: PCAP file exportgithub.com/GyulyVGC/sniffnet/wiki/PCAP-file-export
  9. Wiki: Network hostsgithub.com/GyulyVGC/sniffnet/wiki/Network-hosts
  10. Wiki: Custom databasesgithub.com/GyulyVGC/sniffnet/wiki/Custom-databases
  11. Wiki: Programsgithub.com/GyulyVGC/sniffnet/wiki/Programs
  12. Wiki: Notificationsgithub.com/GyulyVGC/sniffnet/wiki/Notifications
  13. Wiki: Remote notificationsgithub.com/GyulyVGC/sniffnet/wiki/Remote-notifications
  14. Wiki: FAQgithub.com/GyulyVGC/sniffnet/wiki/FAQ
  15. Threat model (THREAT_MODEL.md)github.com/GyulyVGC/sniffnet/blob/main/THREAT_MODEL.md
  16. Source code: update check (check_updates.rs)github.com/GyulyVGC/sniffnet/blob/main/src/utils/check_updates.rs

Checked on 2026-10-25

Similar tools

Wireshark

Impact Reaches others
wireshark/wireshark

A packet analyzer that records network traffic and breaks each packet down by protocol so you can read it.

Purpose
Learning
Type
Desktop app
Difficulty
Beginner
License
CopyleftGPL-2.0
Category
Network / Forensics
Actively updatedstars10,082Last update 2026-10-25
Read the Wireshark review