DOCSEARCHbyAlgolia
Submit Docs

Sniffnet

repository·main·Indexed 13 days ago

https://github.com/gyulyvgc/sniffnet

A cross-platform, intuitive application for monitoring and analyzing Internet traffic. Sniffnet provides real-time statistics, geographical host identification, protocol inspection, and program tracking. It supports importing and exporting capture reports as PCAP files, custom UI themes via TOML, and a CLI for adapter selection and configuration management. Version 1.5.1.

Tokens
6.2K
Snippets
25
Records
33
Agent score
99%

What's inside Sniffnet

  1. Overview of Sniffnet features

    main

    Sniffnet is a cross-platform application for monitoring Internet traffic. Key capabilities include:

    • Traffic Inspection: Choose a network adapter, apply filters, and inspect connections in real time.
    • Analysis & Visualization: View real-time charts of traffic intensity, overall statistics, and identify connections in your local network.
    • Host Identification: Discover geographical locations, domain names, and ASNs of remote hosts. Identify 6000+ upper layer services, protocols, trojans, and worms.
    • Reporting: Import and export capture reports as PCAP files.
    • Customization: Set custom notifications for network events, import custom IP blacklists, and use custom themes.
    • Program Tracking: See which specific programs are generating network traffic.

  2. Report a security vulnerability in Sniffnet

    main

    If you discover a security vulnerability, do not report it through public GitHub issues, Pull Requests, or commit messages. Instead, follow the project's security protocols to ensure the issue is handled privately.

    To report a vulnerability:

    1. Refer to the SECURITY.md guide for specific reporting instructions.
    2. For all security-related communications, email security@sniffnet.app directly.

  4. Create a custom theme for Sniffnet

    main

    Sniffnet allows customization of its UI via theme files. Themes are defined using a TOML structure where all color values must be provided in RGB/RGBA hexadecimal format.

    To create a theme, define the following keys in a TOML file:

    • primary: The main background color.
    • secondary: The color for headers, footers, and incoming connections.
    • outgoing: The color for outgoing connections.
    • text_body: The color for body text.
    • text_headers: The color for text within headers and footers.
    • starred: The color for the star icon used for favorites.
    # all colors are in RGB/RGBA hexadecimal.
primary = "#303446"           # background color
secondary = "#a6d189"         # header, footer, and incoming connections color
outgoing = "#f4b8e4"          # outgoing connections color
text_body = "#c6d0f5"         # body text color
text_headers = "#232634"      # header and footer text color
starred = "#e5c890"           # favorites' star color

  5. Understand the Sniffnet configuration structure

    main

    Sniffnet uses a central Conf structure to manage application settings, including network device selection, BPF filters, window dimensions, and user preferences like favorites and sort types.

    Configurations are persisted to disk using the confy crate. The application is designed to be fault-tolerant during deserialization:

    • Missing fields are populated using the Default implementation of the struct.
    • Invalid fields are replaced with their type's Default value.
    • Extra fields in the configuration file are ignored.
    • Sanitization occurs immediately after loading to ensure values like scale_factor (must be between 0.3 and 3.0) and notification volume (must be between 0 and 100) are within valid ranges.

  6. Search and filter parameters for reports

    main

    The SearchParameters struct defines the criteria used to filter entries in the Sniffnet GUI inspect page. It supports filtering by network attributes (IPs, ports, protocols), host information (domain, country, AS name), and metadata (service, program, favorites, or blacklisted status).

    Filter Syntax

    Filters are applied using string matching logic:

    • Contains (Default): A standard string (e.g., google) matches any entry containing that substring.
    • Exact Match: Prefix the search term with = (e.g., =80) to match the value exactly.
    • Not Equal: Prefix the search term with != (e.g., !=80) to exclude exact matches.
    • Not Contains: Prefix the search term with ! (e.g., !google) to exclude entries containing that substring.
    pub struct SearchParameters {
    pub address_src: String,
    pub port_src: String,
    pub address_dst: String,
    pub port_dst: String,
    pub proto: String,
    pub service: String,
    pub country: String,
    pub domain: String,
    pub as_name: String,
    pub program: String,
    pub only_favorites: bool,
    pub only_blacklisted: bool,
}

  7. Run Sniffnet application

    main

    Sniffnet is a network monitoring application. The main entry point initializes the application configuration, handles CLI arguments, and launches the GUI using the iced framework.

    When running the application, it automatically:

    • Loads configuration from CONF.
    • Processes CLI arguments via cli::Args::handle() to determine the boot task chain.
    • Sets up window properties including size, position, and custom fonts (SARASA_MONO_BYTES and ICONS_BYTES).
    • On Linux, it uses the application ID sniffnet for Wayland compatibility.
    • On Windows (release builds), it redirects stdout/stderr to a file for logging purposes.
    # Sniffnet is typically run as a compiled binary.
# The application handles its own initialization via the main() function.

  8. Fix rendering problems in Sniffnet

    main

    If you experience graphical glitches, unsupported color gradients, or black icons (often due to outdated drivers or old architectures), you can switch from the default wgpu renderer to the tiny-skia renderer. tiny-skia is a CPU-only software renderer that is more compatible with older environments.

    To use it, set the ICED_BACKEND environment variable to tiny-skia before launching the application.

    ICED_BACKEND=tiny-skia

  9. Configure Sniffnet notifications

    main

    The Notifications struct manages all user-defined notification settings. It includes global volume control and specific configurations for different event types: data usage, favorites, IP blacklists, and remote notifications.

    Key fields:

    • volume: A u8 value representing the notification volume.
    • data_notification: Configuration for data usage thresholds.
    • favorite_notification: Configuration for favorite events.
    • ip_blacklist_notification: Configuration for IP blacklist events.
    • remote_notifications: Configuration for sending notifications to a remote URL.

  10. Retrieve the configuration file path

    main

    If you need to locate the configuration file used by Sniffnet (to manually edit settings or back them up), use the --config-path flag. The command will output the path to stdout and exit.

    sniffnet --config-path

  11. Start sniffing from a specific adapter via CLI

    main

    To bypass the manual device selection in the GUI and immediately start monitoring a specific network interface, use the --adapter (or -a) flag followed by the adapter name.

    sniffnet --adapter "en0"

  12. Restore default settings

    main

    To reset all Sniffnet settings (including themes, language, and device selection) to their original default values, use the --restore-default flag. This will overwrite the current configuration file with the default settings.

    sniffnet --restore-default