4 ms·
Until Linux duplicates that BSD tagging of inbound packets to process ID, no Linux-derivative LittleSnitch is going to match macOS/BSD-variant LittleSnitch’s ca
by egberts1 4y ago
Until Linux duplicates that BSD tagging of inbound packets to process ID, no Linux-derivative LittleSnitch is going to match macOS/BSD-variant LittleSnitch’s capability set of detecting WHICH application having received a network packet.
Given the above, sandboxing with namespace nftable is still required for ultimate inbound security (I am looking at you, systemd).
- frankharv 4y agoWhat is the BSD equivalent of a Application Firewall?
- egberts1 4y agoIt is a notation macOS/BSD. Not macOS and BSD.
- xyzzy_plugh 4y agoThis is very easy to accomplish with eBPF, which OpenSnitch appears to use, but I didn't review it sufficiently to determine if that's how they're associating processes with packets. IIRC the problem with tagging in Linux is that there isn't necessarily a 1:1 relationship with a destination PID and a packet in a variety of scenarios.
- deleted 4y ago[deleted]
- rasz 4y agodoesnt the bpf solve this? https://www.gcardone.net/2020-07-31-per-process-bandwidth-monitoring-on-Linux-with-bpftrace/ https://www.gcardone.net/2020-07-31-per-process-bandwidth-mo...