Sniffnet – Comfortably monitor your internet traffic (like Wireshark)

https://www.sniffnet.net/

by kristianpaul • 3 years ago

240 60 3 years ago

"If you're looking for a quick and easy way to monitor your network traffic, this cross-platform app written in Rust definitely passes the Sniff Test"

1970-01-01• 3 years ago

Just tried it, and it works. This would be an amazing tool on a home router.

synergy20• 3 years ago

openwrt has things like this for a while, via its web interface

petters• 3 years ago

Does it support installing a certificate for inspection of https traffic? (Like mitmproxy)

lucb1e• 3 years ago

The screenshot shows traffic volume per destination. I don't see a feature that would require traffic decryption nor any mention of how to install a cert, so I assume no. What would you want traffic decryption for?

1vuio0pswjnm72• 3 years ago

"What would you want decryption for?"

Not OP, but here's a Google employee explaining why one would want to decrypt traffic.

https://web.archive.org/web/20220813220108if_/https://medium...

1vuio0pswjnm72• 3 years ago

Anything wrong with mitmproxy (not a user myself, just curious)

PradeetPatel• 3 years ago

Nothing in particular, although it's UI is quite dated and not very user friendly.

acrophiliac• 3 years ago

This question probably identifies me as a dinosaur, but ... is there a user manual? I didn't see one in the README or on the web site.

smartmic• 3 years ago

Hey, you greybeard. I couldn't find a manual either on first glance but, hey, we know about Github stars and see many colorful emoji and symbols on the frontpage.

No, irony left aside. I also miss the clean, boring but highly useful landing pages of old-school utility programs. A short description and a well written man page was all we needed, plus some screenshots for TUI/GUI programs.

My feeling is that especially Rust enthusiasts like emoji, colors and banners a lot. But maybe I am also just getting old...

kunwon1• 3 years ago

I learned Perl as a first programming language, and to this day I maintain that their documentation is better than that of any other language I've tried. Putting a synopsis with example syntax at the very beginning is, IMO, the ideal.

Example at [1]. I can take this and run with it, after reading for less than 15 seconds I know enough to start working.

[1] https://metacpan.org/release/TIMB/DBI-1.616/view/DBI.pm

skinner927• 3 years ago

Any time I see an emoji, I just want to turn away. I don’t know why I’m so resistant to them. Possibly because I feel I can’t take anyone seriously who would bother to pull up an on-screen keyboard just to add a little rocket ship to a line for almost no reason.

jck• 3 years ago

Not affiliated with the project, but just took a look at their readme. It literally lists how to install it on every single platform, how to launch it, what features it has, keyboard shotcuts and troubleshooting steps.

I thought it was a great readme. It is weird how you guys dismissed the whole thing just because the readme has emojis.

pdimitar3• 3 years ago

I am not a fan of overusing emoji myself, but how did you manage to involve Rust enthusiasts will forever remain a mystery...

devilsAdv0cate• 3 years ago

Oh, dear dinosaur friend, user manuals are so last millennium! Who needs them when you have the power of exploration and experimentation at your fingertips? Embrace the digital age and dive right in. You’ll figure it out in no time!

radec• 3 years ago

I was looking for a manual as well. I kinda like looking through a manual to see if I'm interested before installing.

_lvbh• 3 years ago

https://github.com/GyulyVGC/sniffnet

kaueg• 3 years ago

In the past i was looking for a network sniffer software to detect DDoS attacks that works on Windows. To manually monitor a game server i was running, Sniffnet worked well even durring DDoS attacks.

ivanstegic• 3 years ago

Sounds perfect for a container and raspberry Pi!

AstraZenecat• 3 years ago

can I ask why one would use this over wireshark?

zamadatix2• 3 years ago

Despite the title there is really not much relation beyond both tools monitor traffic. In general though, I'd say Wireshark is geared towards inspecting specific things while this is geared towards being a dashboard and filter of your overall network's internet traffic.

candiddevmike• 3 years ago

jnettop works really well from the commandline. Does what it says on the tin--like top, only for network traffic.

danielvaughn• 3 years ago

I'm curious how this holds up against something like Charles Proxy.

tguvot2• 3 years ago

it feels like its more "like ntop" and not "like wireshark"

UI_at_80x24• 3 years ago

Or "iftop" And yes. Nothing like wireshark.

tguvot2• 3 years ago

iptraf

buildbot• 3 years ago

For the CLI, I recently found bandwich: https://github.com/imsnif/bandwhich

The cargo install is currently borked but the prebuilt bin works fine.

unixhero• 3 years ago

Application layer protocols are inferred from the transport port numbers, following the convention maintained by IANA.

bazmattaz• 3 years ago

Would love to see a tutorial for getting this setup on a raspberry pi with a web GUI on a local IP

fiddyschmitt• 3 years ago

Can it throttle individual connections like NetLimiter?

Jedd5• 3 years ago

These tools are interesting to play with but I'd prefer to leverage netflows, which are designed for this purpose.

Netflow gives you protocol types, src/dst ip & port, packet & byte counts, qos/tos, and more - much more cheaply than pcapping an interface. All SME and up gear support them, even Unifi USG's will eject NetFlows.

I'm a bit jaded about some of the free tooling these days though. Weirdly it feels like we've taken a step back the past several years - but for anything beyond 'I wonder who this one computer is talking to' they're a much better approach.

unethical_ban• 3 years ago

Sure, just gotta spin up an elastic stack and find the right netflow parser! I know you know. Netflow to me is like snmp, supposedly easy but really not. Maybe I'm just lazy now.

Jedd5• 3 years ago

I played with Elastiflow extensively some years ago - it was excellent, if a little hungry on memory, but I suspect most of that was the logstash & elasticsearch overhead.

Rob did a big rewrite about 4 years ago, I think, licensing the new codebase in a way that led us to look elsewhere.

There's some alternatives that aren't elastic under the hood, of course. The hard-to-type Akvorado looks very promising, especially given its heritage:

https://github.com/akvorado/akvorado

Because we're moving to opentel / prometheus, this project (seems quite active) is especially interesting, with the promise of integrating OS & app metrics, tracing, and netflow insights:

https://github.com/netobserv/flowlogs-pipeline

jwiz• 3 years ago

I thought netflows were all just sampled nowadays, though. That is, if you want to see every packet, you can't use netflow.

If you just want the general characterization of your data, then they are ok.

Jedd5• 3 years ago

Nowadays? The protocols haven't changed, but you may mean that pipes are getting bigger while compute/storage aren't keeping up, so network admins are more likely to opt for sampling over raw/full.

If you want to see every connection you certainly can use netflow, just means you need to spec out your solution properly - and if you've got a lot of chatty traffic it may get expensive.

Obviously much less expensive than interface capture approaches like TFA - plus netflows will typically come from your routing infrastructure.

EDIT: Apologies, I had not really processed the implications of 'if you want to see every packet'. Yes, you're right, but netflow was never about seeing every packet, but tracking every flow (which IIRC is usually defined as src/dst addr+port + protocol) - which will include a running total of bytes/packets over time, so it's counting every packet, but certainly not inspecting every packet, at least not in a DPI sense.

Netflow will inspect every connection as it's established, and then track it until it's torn down. This is one of the reasons netflow, and especially sampled netflow, can report really skewed results against long-lived connections - think Citrix, f.e.

zamadatix2• 3 years ago

SFlow is the packet sampled version, Netflix/Ipfix will give you details on every flow. There was a period high speed devices (>10G) started dropping full sampling but it seems to have come back for even 100G devices. Limits around the total number of tracked flows still exist of course, you can't just flood a trillion tcp syns and on a 100G port and expect the switch to report on all of them. Theoretically you could do that with a pcap based solution but realistically it's the same problem the switch runs into.

Now if you actually care about per packet statistics rather than per flow statistics you'd want pcap. The more the world becomes encrypted the less interesting the actual packets become.

fulafel• 3 years ago

Besides the obvious advantages (you don't need to control the network & have the feature support in hw & have the energy to configure netflow stuff) - host local viewpoint has a lot of advantages vs monitoring from a on-path network element. You can associate stuff to local processes, you don't have the post-NAT warped view of traffic, you can see traffic that doesn't cross routers, you can see the actual traffic contents instead of just metadata, etc.

But the high bit is of course that it's a self-contained normal app and just works.

(And it actually exists unlike the hypothetical netflow version.)

Jedd5• 3 years ago

Some good points, and I appreciate there are two semi-disparate domains here. Local interface monitoring addresses a different problem than network monitoring.

I'd argue your advantages perhaps - you do need local root, or at least net_admin / net_raw (I haven't looked to see if TFA drops all but these - perhaps you have?) which raises some security questions. In Linux you may also hit some challenges with promiscuous mode, or capturing on wireless interfaces.

The 'energy' to configure netflow is probably comparable to that required to install and configure this tool. If you don't have the feature on your network hardware, then, yeah, sure, it's moot.

I accept that this, and other existing tools, that let you correlate local processes with local network interface activity can be useful. In my experience it's rare to have to dive into that level, but definitely handy.

In a previous life I would frequently be flipping between Wireshark and Riverbed's Packet Analyzer (nee Pilot) which gives a higher level view than Wireshark. It feels like Sniffnet is aiming to be more in this category, so it's great to have a free software alternative.

For traffic that doesn't traverse routers, you may not know that switches can send netflow. Also, your favourite GNU/Linux distro can send flows.

(And it actually exists unlike the hypothetical netflow version.)

I don't get this bit.

Are you asserting that netflow monitoring tools don't exist?

nikau• 3 years ago

seems more like a gui version of ntop rather than anything near the feature set of wireshark.

chriscjcj• 3 years ago

I don't see any way to open an individual packet and inspect the payload. Maybe I'm missing something. If Sniffnet doesn't do that, perhaps it's a bit inappropriate to say it's "like Wireshark."

olvy0• 3 years ago

They say that on Windows you need to install Npcap first as a dependency [0].

However Npcap's free edition is limited to 5 installations, with unlimited installations only allowed when used with Nmap, Wireshark, and/or Microsoft Defender for Identity [1]. Anything beyond that requires a license.

I'm not sure if that's problematic. Sniffnet don't distribute Npcap themselves so they're ok, I guess, but they do require their users to install it on Windows . So I guess this means that for private use someone can install Sniffnet + Npcap on up to 5 computers, but organizations with Windows systems cannot use Sniffnet + Npcap unless they buy Npcap's license.

[0] https://github.com/GyulyVGC/sniffnet#required-dependencies

[1] https://npcap.com/#download

kkarakk2• 3 years ago

i guess that explains why they don't install that automatically, was wondering about that.

rixed2• 3 years ago

Not to take anything away from Sniffnet, but if people are interested in real-time network monitoring for their personal computer with a nice GUI, and if someone can suggest a nice GUI portable and useable ultimately from C, I would consider adding a GUI to an old free software tool that's been developed years ago for the telco industry and that has many more features.

vGPU2• 3 years ago

Can’t help with the GUI, but would be interested in knowing more about the tool.

rixed2• 3 years ago

https://github.com/rixed/junkie

armitron• 3 years ago

The title is misleading, this seems like a toy and not at all like Wireshark since it doesn't do dissection.

ntopng (https://www.ntop.org/products/traffic-analysis/ntop/) is much more featureful than sniffnet, works also with netflow and has seen multiple production deployments, monitoring 100Gbps flows at full rate.

INTPenis• 3 years ago

Kinda annoying that you can't copy an IP from the GUI. You have to open the full report in a spreadsheet program, find it and copy it.

kkarakk2• 3 years ago

Is there some reason the installer doesn't install the dependencies?

Sniffnet – Comfortably monitor your internet traffic (like Wireshark)

Related Stories