6 ms·
Sniffnet – Comfortably monitor your internet traffic (like Wireshark)
- kristianpaul 3y ago"If you're looking for a quick and easy way to monitor your network traffic, this cross-platform app written in Rust definitely passes the Sniff Test"
- 1970-01-01 3y agoJust tried it, and it works. This would be an amazing tool on a home router.
- synergy20 3y agoopenwrt has things like this for a while, via its web interface
- petters 3y agoDoes it support installing a certificate for inspection of https traffic? (Like mitmproxy)
- lucb1e 3y agoThe screenshot shows traffic volume per destination. I don't see a feature that would require traffic decryption nor any mention of how to install a cert, so I assume no. What would you want traffic decryption for?
- 1vuio0pswjnm7 3y ago"What would you want decryption for?" Not OP, but here's a Google employee explaining why one would want to decrypt traffic. https://web.archive.org/web/20220813220108if_/https://medium.com/max-greenwalds-blog/mitmproxy-your-d-i-y-private-eye-57e6be2a1273 https://web.archive.org/web/20220813220108if_/https://medium... More from F5. https://www.f5.com/solutions/use-cases/ssl-visibility https://www.f5.com/solutions/use-cases/ssl-visibility
- 1vuio0pswjnm7 3y agoAnything wrong with mitmproxy (not a user myself, just curious)
- PradeetPatel 3y agoNothing in particular, although it's UI is quite dated and not very user friendly.
- acrophiliac 3y agoThis question probably identifies me as a dinosaur, but ... is there a user manual? I didn't see one in the README or on the web site.
- _lvbh 3y agohttps://github.com/GyulyVGC/sniffnet https://github.com/GyulyVGC/sniffnet
- smartmic 3y agoHey, you greybeard. I couldn't find a manual either on first glance but, hey, we know about Github stars and see many colorful emoji and symbols on the frontpage. No, irony left aside. I also miss the clean, boring but highly useful landing pages of old-school utility programs. A short description and a well written man page was all we needed, plus some screenshots for TUI/GUI programs. My feeling is that especially Rust enthusiasts like emoji, colors and banners a lot. But maybe I am also just getting old...
- pdimitar 3y agoI am not a fan of overusing emoji myself, but how did you manage to involve Rust enthusiasts will forever remain a mystery...
- kunwon1 3y agoI learned Perl as a first programming language, and to this day I maintain that their documentation is better than that of any other language I've tried. Putting a synopsis with example syntax at the very beginning is, IMO, the ideal. Example at [1]. I can take this and run with it, after reading for less than 15 seconds I know enough to start working. [1] https://metacpan.org/release/TIMB/DBI-1.616/view/DBI.pm https://metacpan.org/release/TIMB/DBI-1.616/view/DBI.pm
- innocentoldguy 3y agoLarry’s background probably had a lot to do with the quality of his documentation.
- kaueg 3y agoIn the past i was looking for a network sniffer software to detect DDoS attacks that works on Windows. To manually monitor a game server i was running, Sniffnet worked well even durring DDoS attacks.
- ivanstegic 3y agoSounds perfect for a container and raspberry Pi!
- AstraZenecat 3y agocan I ask why one would use this over wireshark?
- zamadatix 3y agoDespite the title there is really not much relation beyond both tools monitor traffic. In general though, I'd say Wireshark is geared towards inspecting specific things while this is geared towards being a dashboard and filter of your overall network's internet traffic.
- candiddevmike 3y agojnettop works really well from the commandline. Does what it says on the tin--like top, only for network traffic.
- danielvaughn 3y agoI'm curious how this holds up against something like Charles Proxy.
- tguvot 3y agoit feels like its more "like ntop" and not "like wireshark"
- UI_at_80x24 3y agoOr "iftop" And yes. Nothing like wireshark.
- tguvot 3y agoiptraf
- buildbot 3y agoFor the CLI, I recently found bandwich: https://github.com/imsnif/bandwhich https://github.com/imsnif/bandwhich The cargo install is currently borked but the prebuilt bin works fine.
- unixhero 3y agoApplication layer protocols are inferred from the transport port numbers, following the convention maintained by IANA.
- bazmattaz 3y agoWould love to see a tutorial for getting this setup on a raspberry pi with a web GUI on a local IP
- fiddyschmitt 3y agoCan it throttle individual connections like NetLimiter?
- deleted 3y ago[deleted]
- Jedd 3y agoThese tools are interesting to play with but I'd prefer to leverage netflows, which are designed for this purpose. Netflow gives you protocol types, src/dst ip & port, packet & byte counts, qos/tos, and more - much more cheaply than pcapping an interface. All SME and up gear support them, even Unifi USG's will eject NetFlows. I'm a bit jaded about some of the free tooling these days though. Weirdly it feels like we've taken a step back the past several years - but for anything beyond 'I wonder who this one computer is talking to' they're a much better approach.
- unethical_ban 3y agoSure, just gotta spin up an elastic stack and find the right netflow parser! I know you know. Netflow to me is like snmp, supposedly easy but really not. Maybe I'm just lazy now.
- Jedd 3y agoI played with Elastiflow extensively some years ago - it was excellent, if a little hungry on memory, but I suspect most of that was the logstash & elasticsearch overhead. Rob did a big rewrite about 4 years ago, I think, licensing the new codebase in a way that led us to look elsewhere. There's some alternatives that aren't elastic under the hood, of course. The hard-to-type Akvorado looks very promising, especially given its heritage: https://github.com/akvorado/akvorado https://github.com/akvorado/akvorado Because we're moving to opentel / prometheus, this project (seems quite active) is especially interesting, with the promise of integrating OS & app metrics, tracing, and netflow insights: https://github.com/netobserv/flowlogs-pipeline https://github.com/netobserv/flowlogs-pipeline
- jwiz 3y agoI thought netflows were all just sampled nowadays, though. That is, if you want to see every packet, you can't use netflow. If you just want the general characterization of your data, then they are ok.
- Jedd 3y ago
- nikau 3y agoseems more like a gui version of ntop rather than anything near the feature set of wireshark.
- chriscjcj 3y agoI don't see any way to open an individual packet and inspect the payload. Maybe I'm missing something. If Sniffnet doesn't do that, perhaps it's a bit inappropriate to say it's "like Wireshark."
- deleted 3y ago[deleted]
- kkarakk 3y agoIs there some reason the installer doesn't install the dependencies?
- rixed 3y agoNot to take anything away from Sniffnet, but if people are interested in real-time network monitoring for their personal computer with a nice GUI, and if someone can suggest a nice GUI portable and useable ultimately from C, I would consider adding a GUI to an old free software tool that's been developed years ago for the telco industry and that has many more features.
- olvy0 3y agoThey say that on Windows you need to install Npcap first as a dependency [0]. However Npcap's free edition is limited to 5 installations, with unlimited installations only allowed when used with Nmap, Wireshark, and/or Microsoft Defender for Identity [1]. Anything beyond that requires a license. I'm not sure if that's problematic. Sniffnet don't distribute Npcap themselves so they're ok, I guess, but they do require their users to install it on Windows . So I guess this means that for private use someone can install Sniffnet + Npcap on up to 5 computers, but organizations with Windows systems cannot use Sniffnet + Npcap unless they buy Npcap's license. [0] https://github.com/GyulyVGC/sniffnet#required-dependencies https://github.com/GyulyVGC/sniffnet#required-dependencies [1] https://npcap.com/#download https://npcap.com/#download
- kkarakk 3y agoi guess that explains why they don't install that automatically, was wondering about that.
- rotzgoober 3y ago[dead]
- armitron 3y agoThe title is misleading, this seems like a toy and not at all like Wireshark since it doesn't do dissection. ntopng (https://www.ntop.org/products/traffic-analysis/ntop/ https://www.ntop.org/products/traffic-analysis/ntop/) is much more featureful than sniffnet, works also with netflow and has seen multiple production deployments, monitoring 100Gbps flows at full rate.
- INTPenis 3y agoKinda annoying that you can't copy an IP from the GUI. You have to open the full report in a spreadsheet program, find it and copy it.