GyulyVGC/sniffnet

What it does

Sniffnet is a desktop application for observing the traffic flowing through a selected network adapter. Instead of presenting a raw packet stream, it turns captures into an overview: live traffic charts, per-connection inspection, local-network hosts, remote IP geolocation, domain names and ASNs, and identification of upper-layer services and protocols. It can also attribute bandwidth to the programs generating it and highlight connections matching imported IP blacklists.

It targets people who want practical visibility into their own machine's network activity — checking which applications are talking to the internet, spotting unfamiliar remote hosts, or reviewing traffic patterns — without operating a full protocol analyzer. Capture reports can be imported and exported as PCAP files for use elsewhere.

The source is Rust, using the iced GUI library; packaged builds are published for Windows, macOS, and Linux.

Getting started

1. Pick the installer for your platform from the latest release: Windows .msi (x64, arm64, x86), macOS .dmg (Intel or Apple silicon), or Linux .deb, .rpm, or .AppImage packages. Other installation routes are documented in the wiki's alternative installation methods.
2. Install the required dependencies for your OS; the README warns that missing dependencies are the most common cause of adapter-analysis errors.
3. Launch Sniffnet, choose the network adapter to inspect, and optionally apply filters to the observed traffic.
4. Watch the overview and real-time charts, then open individual connections to inspect remote hosts, domains, ASNs, and services. Export a capture as PCAP if you need the raw data.

If the interface glitches or icons render black on older hardware or outdated graphics drivers, switch from the default wgpu renderer to the CPU-only tiny-skia renderer by setting:

ICED_BACKEND=tiny-skia

Step-by-step usage, tips, and FAQ entries are in the Sniffnet Wiki.

Constraints

• At least one adapter must be visible and analyzable by the OS; missing system dependencies prevent this.
• The default GPU renderer can misbehave on older architectures or outdated drivers; the tiny-skia fallback is provided for that case.
• The GUI and all documentation are English-first, though the interface is translated into many languages.
• IP geolocation and ASN data come from MaxMind; place names and network ownership depend on that data rather than being resolved locally.
• The project is Apache-2.0 licensed and offers packaged binaries plus a source build; commercial support is not part of the listed material.

HotRepo's take

Sniffnet has appeared repeatedly in Hacker News discussions: a May 2023 thread drew 288 points and 38 comments, and a February 2025 thread drew 256 points and 94 comments (earlier discussion, later discussion). The 2025 thread's conversation drifted toward router-level and DNS-level monitoring — Pi-hole and mitmproxy were suggested for per-device or full-URL logging (comment, reply, reply) — which marks a real boundary: Sniffnet observes traffic on the machine where it runs, not every device on a network. In the 2023 thread, commenters praised the interface while noting that the Rust-only iced GUI ecosystem was still young (comment, reply).

The repository's only recorded HotRepo snapshot is a Rust daily list entry from 2026-11-08 with 30 stars gained and a best position of 11; there is no full-language daily ranking on record, so it supports no broader popularity claim. Treat the large star count as interest, not verification of monitoring accuracy.