Sniffnet — Cross-Platform Network Traffic Monitor with Real-Time Charts

Introduction

Sniffnet makes network monitoring accessible to everyone. Instead of wading through raw packet dumps, it presents real-time traffic data in a clean graphical interface with charts, maps, and alerts.

What Sniffnet Does

• Captures and classifies network packets by protocol, host, and application layer
• Displays live bandwidth charts showing incoming and outgoing traffic
• Identifies remote hosts and geolocates them on an interactive map
• Triggers custom notifications when traffic thresholds are exceeded
• Exports captured data for offline analysis

Architecture Overview

Sniffnet is built in Rust using the pcap library for packet capture and the iced framework for its cross-platform GUI. It runs a background capture thread that feeds parsed packet metadata into the rendering pipeline, keeping the UI responsive even under heavy traffic. No data leaves your machine.

Self-Hosting & Configuration

• Requires administrative or root privileges for raw packet capture
• Select a network adapter on first launch; supports Wi-Fi, Ethernet, and VPN interfaces
• Configure notification thresholds for bytes, packets, or specific hosts
• Choose between multiple visual themes and chart styles
• Available on Linux, macOS, and Windows with native installers

Key Features

• Entirely local and privacy-respecting — no telemetry, no cloud
• Real-time geographic mapping of remote connections
• Application-layer protocol identification (HTTP, DNS, TLS, SSH, and more)
• Lightweight Rust binary with low CPU and memory footprint
• Fully open source under MIT/Apache-2.0 dual license

Comparison with Similar Tools

• Wireshark — far more powerful for deep packet inspection but steeper learning curve; Sniffnet focuses on overview monitoring
• bandwhich — terminal-only bandwidth tool per process; Sniffnet adds a GUI, geo-mapping, and alerts
• ntopng — enterprise-grade network analytics server; Sniffnet is a lightweight desktop app with zero setup
• nethogs — shows per-process bandwidth in the terminal; Sniffnet provides richer visualization

FAQ

Q: Does Sniffnet require a server or daemon? A: No. It runs as a standalone desktop application with no background service required.

Q: Can it monitor traffic on remote machines? A: Sniffnet monitors the local machine only. For remote use, run it directly on the target host.

Q: Which protocols does it recognize? A: It classifies traffic at the transport and application layers, covering TCP, UDP, ICMP, HTTP, DNS, TLS, SSH, DHCP, and more.

Q: Is it suitable for production server monitoring? A: It is designed as a desktop tool. For server-grade monitoring, consider Prometheus or Netdata.

Sources

• https://github.com/GyulyVGC/sniffnet
• https://sniffnet.net