Sniffnet: Real-Time Network Traffic Monitor
/sniffnet
Sniffnet is a Rust-built, iced-powered app for watching live network traffic without touching a packet-math console. It nails the everyday question — which program is hogging bandwidth right now — with real-time charts, adapter selection, and per-connection geolocation. It's not a substitute for deep packet inspection: there's no field-by-field decoder, so treat it as a traffic dashboard, not a protocol analyzer.
What is Sniffnet?
Sniffnet is a cross-platform desktop application, written in Rust with the iced GUI toolkit, that captures and visualizes network traffic in real time. Pick a network adapter and it renders live charts of traffic intensity next to a list of active connections, each tagged with domain name, ASN, and geographic location where available. It also recognizes more than 6000 upper-layer services, protocols, trojans, and worms.
Key features for network traffic monitoring
- ✓Pick any network adapter on your machine and Sniffnet starts charting its traffic immediately.
- ✓Real-time charts show traffic intensity as it happens, not after the fact.
- ✓Filters narrow the view down to the connections you actually care about.
- ✓Import and export full capture reports as PCAP files for later analysis in other tools.
- ✓Each connection gets tagged with domain name, ASN, and — where available — the geographic location of the remote host.
- ✓Recognizes a long list of built-in upper-layer services, protocols, and known trojans/worms, tagging what you're actually talking to.
- ✓Custom notifications fire when defined network events occur, and IP blacklists highlight connections worth a second look.
- ✓Custom themes, if the stock look isn't your thing.
What can you monitor with Sniffnet?
- •Catching a background process that's silently uploading or downloading.
- •Watching bandwidth per program to see which app is actually saturating your connection.
- •Mapping where your traffic geographically goes, host by host.
- •Auditing a machine for connections to hosts on an IP blacklist you supply.
- •Keeping a live eye on network activity while the window is minimized.
Downloading and installing Sniffnet
Sniffnet ships as pre-built binaries straight from GitHub releases — no need to compile the Rust source yourself. Windows and Intel/Apple silicon Mac builds are available. So are Linux packages: AppImage (amd64, arm64, i386, armhf), DEB (amd64, arm64, i386, armhf), and RPM (x86_64, aarch64). No apt or brew listing exists. The README also points to a wiki page for alternative installation methods and OS-specific required dependencies, which aren't detailed in the repo itself — check that page before you hit a missing-dependency error. On Windows, the installer's code signing comes from SignPath.io, with the certificate from SignPath Foundation.
Why developers and power users choose Sniffnet
- ✓Nothing to configure before first traffic shows up — pick the adapter, done.
- ✓PCAP export means the capture isn't stuck inside Sniffnet's own UI; you can hand it to Wireshark for deeper digging.
- ✓Per-connection geolocation and ASN lookups save a manual whois lookup for every host you're curious about.
- ✓Cross-platform coverage — Windows, macOS, and Linux — from the same project.
- ✓Runs quietly, so you can leave it monitoring while minimized instead of babysitting a terminal.
Sniffnet's limitations to know before you start
- △No single package-manager install — you either grab the right binary format for your OS or build from source, and matching x64/arm64/AppImage/DEB/RPM correctly is on you.
- △Rendering can glitch on old hardware or outdated GPU drivers; the fix is setting ICED_BACKEND=tiny-skia to fall back to a CPU renderer, an extra step most people won't know to take until something already looks wrong.
- △It identifies known services and protocols against a built-in list, not full packet payload decoding — for that you still need Wireshark or tcpdump.
- △Required dependencies vary by OS and live on a separate wiki page, so first-time setup means an extra page to read before it works.
Sniffnet vs Wireshark and other network analyzers
Frequently asked questions about Sniffnet
Sniffnet is free and open-source software, licensed under Apache-2.0, with its full source code hosted on GitHub. The project's README describes it as completely free and says it relies on sponsorships and donations to fund the time needed to develop and maintain it.
Sniffnet runs on Windows, macOS, and Linux. The GitHub releases page offers Intel and Apple silicon builds for Mac, x64/arm64/x86 builds for Windows, and Linux packages as AppImage, DEB, and RPM across amd64, arm64, i386, and armhf/aarch64 architectures.
Sniffnet can capture and export comprehensive traffic reports as PCAP files, and it can also import existing PCAP captures. That means you can pull a capture out of Sniffnet's own interface and open it in another tool, like Wireshark, for deeper packet-level analysis.
Sniffnet's README does not state this directly, so treat it as not clearly documented. The project's wiki has a page listing required dependencies per operating system, which is the closest official guidance on what your system needs before Sniffnet can access a network adapter.
Sniffnet matches traffic against a built-in list covering more than 6000 upper-layer services, protocols, and even known trojans and worms, tagging each connection it recognizes as you watch. It also resolves the domain name and ASN of remote hosts, adding more context than a bare IP would.
This isn't addressed in Sniffnet's README, so it's not clearly documented one way or the other. Sniffnet's own description only covers monitoring a chosen network adapter — it says nothing about compatibility or conflicts with other capture tools running at the same time.
The problem it solves
Most people have no idea what's actually happening on their network until something breaks — a laptop fan spinning up, a video call stuttering, a mystery upload eating the upstream. The tools that can answer that in real detail, like Wireshark or tcpdump, assume you already know protocol structure and are comfortable reading packet dumps. Sniffnet fills the gap in between: a live, visual answer to "which connection is doing this right now," including which program opened it and where the remote host is, without requiring a networking background.
Who should try it — and who should skip
Try Sniffnet if you're a developer or power user who wants a visual, no-setup answer to what's touching your network — debugging a leaky background service, checking which app just spiked your upload, or keeping half an eye on a machine while you work. Skip it if you need protocol-level packet dissection or scriptable, repeatable captures for a CI pipeline; that's Wireshark or tcpdump territory, and Sniffnet's own README doesn't position it as a replacement for either.
Related repositories
Is sniffnet worth your time?
ChatGPT, Claude and Perplexity can all read this page. Ask one of them what it makes of sniffnet.