DEV Community

aiXis
aiXis

Posted on AI-assisted

I built an open-source alternative to Little Snitch — local-first application firewall & network monitor

#opensource #security #showdev #privacy

Every app on your machine is talking to someone. Most of them never asked your permission.

Snitch is a free, open-source (AGPL-3.0) application firewall and real-time network monitor for Windows, macOS and Linux — think Little Snitch or LuLu, but cross-platform, scriptable, and 100% local. No account, no cloud, no telemetry.

Snitch live map

What it does

  • Sees everything: live map of every outbound connection — remote host, country, ASN, and the exact process responsible
  • Blocks what you don't trust: per-process firewall rules via eBPF, NFQUEUE, nftables or Windows WFP — with ask-on-first-connect prompts
  • Detects threats: a built-in Sigma-compatible rule engine, offline threat-intel feeds, DGA heuristics, ICMP-tunnel and beaconing detection
  • Stays private: packet capture via libpcap/Npcap, enrichment (DNS, TLS SNI, GeoIP via local DB-IP) happens on-device. The API only listens on 127.0.0.1 behind a token
  • Speaks your language: the UI ships in 8 languages — EN, FR, ES, DE, RU, JA, PT-BR, ZH-CN

Why not Scapy / why a custom parser?

The capture engine uses ctypes → libpcap with a small bounded IPv4/IPv6/TCP/UDP/DNS/TLS-SNI parser — no GPL-2.0-only dependencies, and every parse path is length-capped. SNITCH_DEMO=1 replays synthetic traffic through the real pipeline, so you can try it with zero root privileges.

Fleet-ready (if you need it)

Desktop app is the core, but Snitch also ships:

  • a lightweight Rust agent for servers
  • authenticated REST + WebSocket APIs
  • SIEM export (ECS / CEF / JSON / Syslog) — drops straight into Wazuh or Elastic
  • Docker / Helm / Ansible / Salt / GPO deployment, headless & CLI modes
  • declarative snitch.toml config

Try it 

# macOS
brew install aixisstudio/tap/snitch

# Windows (Scoop — pending) or grab the installer from releases
# Docker / Linux / Electron builds all on the repo
Enter fullscreen mode Exit fullscreen mode

⭐ If it's useful, a star helps a lot — and feedback/issues are very welcome.

Repo: https://github.com/aixisstudio/Snitch — Site: https://aixisstudio.github.io/Snitch/

Top comments (0)