DEV Community: aiXis

I built an open-source alternative to Little Snitch — local-first application firewall & network monitor

aiXis — Fri, 23 Oct 2026 06:45:49 +0000

Every app on your machine is talking to someone. Most of them never asked your permission.

Snitch is a free, open-source (AGPL-3.0) application firewall and real-time network monitor for Windows, macOS and Linux — think Little Snitch or LuLu, but cross-platform, scriptable, and 100% local. No account, no cloud, no telemetry.

What it does

Sees everything: live map of every outbound connection — remote host, country, ASN, and the exact process responsible
Blocks what you don't trust: per-process firewall rules via eBPF, NFQUEUE, nftables or Windows WFP — with ask-on-first-connect prompts
Detects threats: a built-in Sigma-compatible rule engine, offline threat-intel feeds, DGA heuristics, ICMP-tunnel and beaconing detection
Stays private: packet capture via libpcap/Npcap, enrichment (DNS, TLS SNI, GeoIP via local DB-IP) happens on-device. The API only listens on 127.0.0.1 behind a token
Speaks your language: the UI ships in 8 languages — EN, FR, ES, DE, RU, JA, PT-BR, ZH-CN

Why not Scapy / why a custom parser?

The capture engine uses ctypes → libpcap with a small bounded IPv4/IPv6/TCP/UDP/DNS/TLS-SNI parser — no GPL-2.0-only dependencies, and every parse path is length-capped. SNITCH_DEMO=1 replays synthetic traffic through the real pipeline, so you can try it with zero root privileges.

Fleet-ready (if you need it)

Desktop app is the core, but Snitch also ships:

a lightweight Rust agent for servers
authenticated REST + WebSocket APIs
SIEM export (ECS / CEF / JSON / Syslog) — drops straight into Wazuh or Elastic
Docker / Helm / Ansible / Salt / GPO deployment, headless & CLI modes
declarative snitch.toml config

Try it

# macOS
brew install aixisstudio/tap/snitch

# Windows (Scoop — pending) or grab the installer from releases
# Docker / Linux / Electron builds all on the repo

⭐ If it's useful, a star helps a lot — and feedback/issues are very welcome.

Repo: https://github.com/aixisstudio/Snitch — Site: https://aixisstudio.github.io/Snitch/

I wanted to know who my computer was talking to — so I built it (and strangers shipped the Windows port)

aiXis — Sun, 18 Oct 2026 20:56:59 +0000

Three weeks ago I wanted to answer a stupidly simple question: who is my computer talking to?

Not "can I capture packets" (Wireshark can, and it's a microscope when I wanted a windshield). Not "block connections" (Little Snitch does that on macOS, $59, and nothing equivalent exists on Windows). Just: a live, visual answer. Which app, which server, which country — right now.

So I built Snitch. Open source, AGPL, EN/FR UI, ~400 stars in three weeks. Here's what I learned — and the part where strangers wrote my Windows port for me.

The build

The constraint I set myself: no heavy dependencies, no telemetry, ever.

Capture: ctypes → libpcap on macOS/Linux, Npcap on Windows. No Scapy — direct bindings are lighter and give exact field control.
Parsing: hand-rolled IPv4/IPv6/TCP/UDP/DNS/TLS-SNI decoders. ~2K lines for the entire pipeline.
Backend: FastAPI + WebSockets + a SQLite ring buffer (24h retention, then it deletes itself — privacy means not hoarding either).
Frontend: React + D3 force graph + TopoJSON world map.
Geolocation: local MaxMind/DB-IP file. IPs never leave the machine.

Security posture as a feature: API on loopback only, token-authenticated, zero outbound calls unless the user explicitly consents to the GeoIP download. For a privacy tool, the code is the promise — AGPL makes it auditable.

The thing I didn't plan

I shipped macOS first and tagged the repo "help wanted" on Windows. Within days:

Users filed bug reports with root-cause analysis included — not "it doesn't work", actual stack traces and the faulty capture path identified
A stranger I'd never spoken to sent three PRs: Npcap capture, network interface selection, a startup crash
Someone else opened the winget package PR

v1.0.5 shipped last week with the Windows port fully working. The most powerful distribution channel this project found wasn't a marketing trick — it was "put a real problem in public, and people who have the same problem show up".

What the traffic data said

Fun meta-moment: Snitch's own referral traffic told the story. A Chinese tech newsletter (ruanyifeng.com) featured the project — suddenly ~20% of traffic was Chinese readers staring at an English README. So now there's a full 中文 README. The data decides; I just listen.

What I'd tell anyone building dev tools

Solve a felt problem. "Who is my machine talking to" is visceral — everyone wonders, nobody can see it.
Local-first is a differentiator now. "No account, no telemetry" isn't a limitation, it's the pitch.
Bilingual/multi-language docs aren't charity — they're distribution to audiences with zero competition.
Issues and Discussions convert. Fast answers turned bug reporters into contributors. That's how my Windows port happened.

Try it

docker run --network host ghcr.io/aixisstudio/snitch   # Linux
# macOS/Windows: releases page — SNITCH_DEMO=1 runs it without admin

Repo: https://github.com/aixisstudio/Snitch — AGPL, bilingual EN/FR (+中文). The "what did you catch?" thread is open, and a ⭐ genuinely helps if it earns it.

How to see every connection your computer makes (live map, 100% local)

aiXis — Sun, 18 Oct 2026 20:56:38 +0000

Your computer is talking to the internet right now. Probably dozens of connections — sync, telemetry, update checks, your open tabs, your apps' background chatter. The question "what is my machine actually doing?" sounds basic, but try answering it and you'll find the tooling is either microscopic (Wireshark) or paywalled.

Here's a practical guide to actually seeing it — including the tool I built for it, Snitch (open source, AGPL — disclosure, it's mine).

The 60-second version

# macOS / Linux — classic but raw
sudo tcpdump -i any -n | head -50        # every packet, no context
netstat -anp tcp | grep ESTABLISHED      # current connections only
lsof -i -nP | head                       # process → socket mapping

# Windows
netstat -ano | findstr ESTABLISHED
Get-NetTCPConnection -State Established  # PowerShell

These answer "what connections exist right now". They don't tell you which app, where the server is, or whether it's suspicious. That gap is exactly what a visualizer fills.

The visualization approach

Snitch renders every connection as a live graph + world map:

Node = your machine at the center, lines to every remote endpoint
Each endpoint labeled: hostname (via reverse DNS + TLS SNI), geolocated country/city — all offline, from a local MaxMind/DB-IP database
Per-app attribution: the connection is drawn to the process that opened it
Timeline: 15/30/60-min traffic volume, 24h of history in a local SQLite file

What makes it different from tcpdump: the data is already processed. Not "packet to 142.250.74.78" — "Chrome → google.com → Frankfurt".

Reading the map: normal vs suspicious

What a normal map looks like: spokes to Apple/Google/Microsoft/your browser tabs' CDNs, your router, other LAN devices.

What stands out:

Beaconing — a connection that fires at regular intervals (Snitch flags these; it's a classic C2 pattern)
Long-lived uploads to unfamiliar endpoints — data leaving steadily to somewhere you don't recognize
Port scans — a LAN host touching many ports on your machine gets flagged
Apps talking to countries that make no sense for what the app does
Trackers — Snitch cross-references hostnames against editable tracker suffix lists and factors them into a privacy score

The built-in anomaly detection watches for all of these automatically, and you can suppress alerts per-rule once you've vetted a pattern.

Install it (2 minutes)

# macOS: download the app from releases, or brew
# Windows: install Npcap → run snitch-backend.exe as Admin
# Linux / Docker:
docker run --network host ghcr.io/aixisstudio/snitch

# No admin rights? Demo mode shows the full UI with synthetic traffic:
SNITCH_DEMO=1 snitch-backend

Everything stays local — token-authenticated API bound to loopback, zero telemetry, no account. That's not a marketing line; it's an AGPL codebase, you can verify the network code path yourself.

Then what?

Once you can see the traffic, the interesting part starts — the community's favorite pastime is the "What did you catch?" thread: printers talking to cloud servers at 3am, TV telemetry, the works.

Repo: https://github.com/aixisstudio/Snitch — ⭐ if it answers the question it set out to answer.

A free, open-source GlassWire alternative — no account, no telemetry, no paywall

aiXis — Sun, 18 Oct 2026 20:56:18 +0000

If you've searched for a network monitor on Windows, you've hit GlassWire. It's polished, it looks great — and then the paywalls start showing up: history behind a subscription, firewall features behind tiers, an account that keeps being suggested, cloud "elite" sync.

There's nothing wrong with paying for software. But "show me what my computer connects to" is basic hygiene — it arguably shouldn't be gated at all. I'm the author of Snitch, a free, open-source (AGPL) alternative, so let me give you the honest comparison instead of a sales pitch.

Snitch vs GlassWire, feature by feature

	Snitch	GlassWire
Price	Free, forever	Freemium — key features paywalled
License	AGPL open source	Proprietary
Account	None — ever	Account/cloud tier promoted
Telemetry	Zero outbound calls (GeoIP download is opt-in)	Phone-home for sync/features
Data location	Local SQLite, yours	Cloud-linked features exist
Live world map of connections	✅ geolocated offline	✅ (paid tiers)
Per-app traffic & bandwidth	✅	✅ (partially free)
History	24h free (SQLite ring buffer)	Limited on free tier
Anomaly alerts (port scans, beaconing, exfil)	✅	✅ (mostly paid)
LAN device scan	✅ passive, via ARP	✅ (paid)
Firewall / blocking	❌ visualizer only	✅ (this is GlassWire's real strength)
Platforms	macOS, Windows, Linux	Windows, Android
Privacy score / tracker detection	✅ editable lists	❌

Where GlassWire still wins

Being fair:

Blocking. GlassWire has a real application firewall. Snitch deliberately doesn't block — it shows you, it doesn't decide. If "deny this app" is your core need, GlassWire (or free Portmaster) is the right tool.
Polish. GlassWire's had a decade of UI work. Snitch is 3 weeks old — the graph is great, the settings are functional, expect edges.
Long history retention — Snitch keeps 24h by design (privacy-first means not hoarding your traffic either).

The architecture difference that matters

GlassWire's model is the industry's: free tier → annoyance → subscription → cloud features. Snitch's model is the opposite: the binary you run is the whole product. Nothing to unlock because nothing is locked. Your traffic history lives in a local SQLite file — and the code is AGPL, so it can't quietly start phoning home without the diff being public.

Concretely: API on loopback with token auth, zero telemetry endpoints, no analytics SDK anywhere in the code (you can grep it — it's open source).

Try it

# Windows: install Npcap, then run the release exe as Administrator
# Linux/Docker:
docker run --network host ghcr.io/aixisstudio/Snitch
# macOS: packaged app or brew
# Demo mode without admin: SNITCH_DEMO=1

Repo: https://github.com/aixisstudio/Snitch — issues and feature requests welcome, the Windows port itself was community-contributed. If it replaces a subscription you didn't want, that's the point. ⭐ if it does.

A free, open-source Little Snitch alternative for Linux

aiXis — Sun, 18 Oct 2026 20:55:57 +0000

Your computer talks to hundreds of servers a day. On Linux the classic answers are tcpdump, ss, netstat, or Wireshark — powerful, but they answer "show me packets", not "who is my machine talking to, and should I worry?".

I built Snitch for that second question — an open-source (AGPL) real-time network visualizer, and it's fully supported on Linux via Docker or the release binary. Full disclosure: I'm the author, so here's an honest rundown of what exists and where Snitch fits.

The Linux landscape

Tool	What it does	What it doesn't
tcpdump / ss / netstat	Raw connection data	No UI, no history, no geolocation, no app mapping
Wireshark	Deep packet dissection	Overkill for "who's phoning home" — it's a microscope, not a dashboard
OpenSnitch	Application firewall (block/allow prompts)	Minimal visualization — it's block-first, and it's Linux-only
iftop / nethogs / nload	Per-interface or per-process bandwidth	No world map, no anomaly detection, no persistence
Snitch	Live map of every connection: app → server → country, anomaly detection, 24h history	Doesn't block (by design — it's a visualizer)

OpenSnitch and Snitch are complementary, not competitors: OpenSnitch decides whether a connection is allowed, Snitch shows you what your machine is doing.

What Snitch gives you on Linux

Live world map of every outbound connection, with process attribution — which app opened it, not just which IP
Offline geolocation via a local MaxMind/DB-IP database — your IPs never leave the machine
Anomaly detection: port scans on your LAN, beaconing (regular-interval callbacks, a classic C2 pattern), unusual outbound volume
Privacy score + tracker detection from editable suffix lists
Per-app bandwidth, timeline, 24h SQLite retention, alert suppression rules
Passive LAN scan via the system ARP table — every device on your network, no packets injected
Bilingual EN/FR UI (中文 README too)

The privacy part

This is the part Linux users tend to verify first, so: the API binds to 127.0.0.1 and requires a token. There is no telemetry, no account, no outbound call at all except an explicitly consent-gated GeoIP database download. Traffic data lives in a local SQLite file you own.

Install

# Docker (host networking needed for packet capture)
docker run --network host ghcr.io/aixisstudio/snitch

# or the release tarball — needs root/cap_net_raw like tcpdump
sudo ./snitch-backend

Then open the printed URL. There's also a demo mode (SNITCH_DEMO=1) that feeds synthetic traffic through the real pipeline if you want to look before granting capture rights.

What's under the hood (for the curious)

Pure Python + ctypes → libpcap for capture — no Scapy dependency. The IPv4/IPv6/TCP/UDP/DNS/TLS-SNI parsing is hand-rolled, ~2K lines for the whole pipeline. FastAPI + WebSocket backend, React + D3 frontend, Electron shell on desktops.

If you want a "does my machine talk to weird places at 3am" answer on Linux without paying for a firewall or running a packet capture all day — that's exactly what this is for. ⭐ on GitHub if it earns it, and the repo's Discussions has a "what did you catch?" thread I'd love to see your screenshots in.

A free, open-source Little Snitch alternative for Windows (yes, it exists)

aiXis — Sun, 18 Oct 2026 20:53:04 +0000

Your computer talks to hundreds of servers every day. Most of it is fine — updates, sync, telemetry you signed up for. Some of it isn't. The question "who is my machine actually talking to?" is the reason Little Snitch has been a macOS staple for 15 years.

The problem: Little Snitch doesn't exist on Windows or Linux. And most Windows "alternatives" are either paid, account-required, or firewall-first when all you wanted was visibility.

I'm the author of Snitch, an open-source (AGPL) real-time network visualizer that just shipped its Windows port — so, full disclosure upfront. Here's the honest state of the options.

First: visualizer vs blocker

Worth being precise, because people conflate them:

Visibility = "show me who my machine talks to" (a map, per-app attribution, history)
Blocking = "let me decide what's allowed" (firewall rules, prompts)

Little Snitch does both. Some alternatives do one or the other. Know which job you need.

The honest comparison

Tool	OS	Block?	Free?	Account required?	Notes
Little Snitch	macOS	✅	paid (~$59)	no	The reference. Nothing like it off macOS.
Snitch	macOS, Windows, Linux	❌ visualize only	✅ AGPL	no	Live world map of every connection, anomaly detection, privacy score. 100% local, zero telemetry.
Portmaster	Win, Linux, macOS	✅	✅ core free	no	DNS-level blocking + app rules. Heavier — runs as a system service.
OpenSnitch	Linux	✅	✅ GPL	no	The closest Linux equivalent — application firewall with prompts.
GlassWire	Windows, Android	✅	freemium	pushes account/cloud	Polished UI, but key features + history are paywalled and it nags about the cloud tier.
Wireshark	all	❌	✅	no	The gold standard for deep packet analysis — but it's for dissecting packets, not answering "who's phoning home right now".
LuLu	macOS	✅	✅	no	Great free macOS firewall — but macOS only, and block-first with minimal visualization.

What Snitch actually does

One sentence: a live map of every connection your computer makes — which app, which server, which country.

Force-graph + world map of connections in real time, geolocated offline (MaxMind/DB-IP — no IP leaves your machine)
Process attribution: which app opened the connection, not just the IP
Anomaly detection: port scans, beaconing patterns, potential exfiltration volume
Privacy score + tracker detection from editable suffix lists
Per-app traffic view, timeline (15/30/60 min), 24h SQLite history
Passive LAN scanner (reads the ARP table — shows every device on your network)

The part that matters to privacy people: everything is local. No account, no telemetry, no outbound calls at all unless you explicitly opt into downloading the GeoIP database. The API is token-authenticated and bound to loopback by default.

What Snitch does NOT do

Honesty section, because HN/Reddit will ask anyway:

It doesn't block. It's a visualizer — it shows you, it doesn't decide for you. If you want blocking on Windows, pair it with Portmaster or use your firewall rules based on what Snitch reveals.
It needs admin/root for packet capture (unavoidable — same as Wireshark).
Windows has no tray app yet — it's a backend exe + the UI in your browser. Works, but less polished than the macOS app.
Deep packet dissection — for that, Wireshark still wins. Snitch is the 10,000-foot view.

Installing on Windows

Install Npcap (the Windows packet-capture driver — required, same dependency as Wireshark)
Grab snitch-backend-windows.zip from the latest release
Run snitch-backend.exe as Administrator
Open the URL it prints — the UI runs in your browser

Linux: docker run --network host ghcr.io/aixisstudio/snitch — or the release tarball. macOS: the packaged app or brew.

A note on how the Windows port happened

I maintain the project solo. The Windows port wasn't me — users filed bug reports with root-cause analysis included, then a stranger sent three PRs that fixed capture + the right network interface + the startup crash. Open source working as advertised. v1.0.5 shipped last week.

If you try it and it catches something interesting, there's a "What did you catch?" discussion on the repo. And if it's useful to you, a ⭐ on GitHub genuinely helps the project get found.

Repo: https://github.com/aixisstudio/Snitch — AGPL, EN/FR UI, 中文 README.

I open-sourced a network monitor — strangers on the internet shipped the Windows port

aiXis — Sat, 17 Oct 2026 10:28:24 +0000

Two weeks ago I open-sourced Snitch, a privacy-first network traffic visualizer. Last week it hit 238 GitHub stars and got picked up by one of the largest tech newsletters in China.

This week the interesting thing happened: strangers started shipping the Windows port for me.

The bug reports that wrote the port

I never hid that Windows was a work in progress. Instead of complaints, I got two of the best bug reports I've ever read:

Issue #25 (MikeDGitHub): the packaged Windows app crashed instantly. He traced it to console=False in the PyInstaller spec leaving sys.stdout/sys.stderr as None — which kills Uvicorn on isatty(). He even included the fix:

if sys.stdout is None:
    sys.stdout = open(os.devnull, 'w', encoding='utf-8')
if sys.stderr is None:
    sys.stderr = open(os.devnull, 'w', encoding='utf-8')

Issue #12 (yjrhot): the app works on Windows 11 but a black console flashes every ~30 seconds. Cause: the LAN scanner shells out to arp -a and route print -4 on a timer, and each spawn opens a visible console. Fix: CREATE_NO_WINDOW.

Both reporters were right. Both fixes are merged.

Then the code showed up

A third person, wufangyong373, didn't file issues — they read the good first issue list and submitted three PRs in a day: per-process icons in the app table, the remaining French translations, and a richer tracker-domain list. All merged. The French comments in their code were better than mine.

v1.0.5 — Windows is live

Snitch v1.0.5 is out:

🪟 Windows supported: packaged backend tarball, runs as admin with Npcap
🍎 macOS app rebuilt (still unsigned — Apple Developer cert is on the roadmap)
🐧 Linux backend tarball + Docker as before
Process icons, richer tracker list, React 19, all deps bumped
The sniffer now picks the interface carrying the default route — no more vEthernet (WSL) reporting zero external hosts

What it still is

The pitch hasn't changed: every connection your computer makes, live, on a node graph and a world map. 347 distinct servers in one hour on my machine, ~17 companies, 158 Google IPs. 100% local, zero telemetry, AGPL-3.0, EN/FR UI.

brew install --cask aixisstudio/tap/snitch   # macOS
# or grab a tarball — https://github.com/aixisstudio/Snitch/releases/tag/v1.0.5

The part nobody tells you about open source

The code is the easy part. The weird, wonderful part is strangers caring enough to debug your sys.stdout handling on an OS you don't even run.

If you're on Windows 11 with 15 spare minutes — issue #12 is looking for testers.

👉 https://github.com/aixisstudio/Snitch

Every app on your Mac is talking to the internet - I built a map of it (zero telemetry)

aiXis — Mon, 05 Oct 2026 10:06:16 +0000

Your Mac makes hundreds of outbound connections every hour — updaters, analytics SDKs, crash reporters, CDNs. None of it is visible unless you go looking. lsof -i gives you a wall of IPs. Little Snitch gives you prompts, a firewall, and a €59 price tag.

We wanted something in between: see everything, block nothing, send nothing. So we built Snitch — an open-source, local-first network traffic visualizer for macOS.

What it does

Live graph of every outbound connection, grouped by process
World map plotting destination IPs — resolved from a bundled GeoIP database, fully offline
Per-app breakdown: bytes in/out, destinations, first-seen vs recurring
Anomaly alerts when a process reaches a destination it has never touched before
Demo mode — explore the full UI with synthetic data, no root required

The part we're most proud of: the privacy model

A network monitor that phones home would be a joke, so we designed around it:

The API binds to 127.0.0.1 only. Nothing listens on a routable interface.
Every endpoint — REST and WebSocket — requires a random token generated per install.
GeoIP lookup happens against a bundled database. No destination IP ever leaves the machine.
No analytics, no crash reporters, no update pings. Snitch makes zero outbound connections itself.

If you watch Snitch with Snitch, you see silence. That's the demo we care about.

How it works

The backend is Python + FastAPI. Per-process attribution comes from polling nettop/lsof rather than a kernel extension — that keeps the app usable without SIP gymnastics and makes the unsigned build tolerable. Connections stream to the React frontend over a token-authenticated WebSocket, rendered as a force-directed graph plus an SVG world map.

The honest trade-off: polling instead of a Network Extension means Snitch visualizes but doesn't block. If you want per-app blocking, pair it with LuLu — they complement each other well.

Current state

macOS build is unsigned for now — right-click → Open, or build from source in ~2 minutes
Windows/Linux builds are on the roadmap (the backend already runs cross-platform)
4 good first issue tickets open if you want to contribute

Links: GitHub · Releases · Wiki · r/SnitchApp

Disclosure: we're aiXis Studio, the studio behind Snitch. The project is AGPL-3.0 and free forever. French version of the docs included — la doc est bilingue.

If it helps you see what your machine is up to, a star on the repo means a lot — and feedback means even more.
Who is your computer talking to right now?

Not a rhetorical question. While you read this, your machine is probably holding dozens of open connections — sync services, CDNs, telemetry endpoints, ads, things you installed three years ago and forgot about. I wanted to see them. Not in a terminal dump, but as a living picture.

So I built Snitch: a free, open-source, 100% local network traffic visualizer.

What it does

Snitch captures outbound traffic in real time and renders it as an animated node graph plus a world map:

Live node graph — every remote host your machine touches, glowing and moving
World map — geolocation of every endpoint, fully offline (MaxMind GeoLite2, no API calls)
Per-process attribution — not just "some connection to 142.250.x.x" but which app opened it
Anomaly detection — port scans, beaconing patterns, suspicious exfiltration volumes
Privacy score — a live rating of how chatty your system is, broken down by trackers/CDNs/normal traffic
Bilingual UI — English and French, switchable at runtime

Why another tool?

Little Snitch / Lulu — macOS-only (Lulu is free, Little Snitch is paid), firewall-centric
GlassWire — Windows-centric, freemium, phones home
Wireshark — the gold standard, but it's a protocol analyzer, not a dashboard; way too heavy to leave running

Snitch sits in the gap: an always-on, glanceable, local-first monitor. The capture is passive (libpcap), the analysis happens on your machine, and nothing — literally nothing — leaves your computer. The API binds to 127.0.0.1 with a bearer token, and there are zero outbound requests by design. It's in the threat model, not just the marketing.

Some engineering choices

Own packet parser instead of Scapy — Scapy is GPL-incompatible with the license I wanted, so I wrote a minimal L2/L3/L4 decoder. Less code than integrating it.
Offline GeoIP — a bundled database beats a "free API" that dies in two years and leaks your traffic metadata to a third party.
Electron + React + FastAPI — desktop app, but the backend runs standalone too (uvicorn + any browser).
Demo mode — SNITCH_DEMO=1 injects synthetic traffic through the real pipeline so you can try it without root/pcap.

Try it

git clone https://github.com/aixisstudio/Snitch
# or one-click install via Pinokio, or Docker, or the Electron builds

Repo: https://github.com/aixisstudio/Snitch — AGPL-3.0. Stars, issues, and PRs welcome. There are a few good first issue tickets open if you want to get involved.

Curious what you'd find on your own machine. Honest feedback welcome — especially on the anomaly heuristics.

I built a local-first Little Snitch alternative that shows every connection your computer makes

aiXis — Fri, 02 Oct 2026 08:17:34 +0000

Who is your computer talking to right now?

So I built Snitch: a free, open-source, 100% local network traffic visualizer.

What it does

Snitch captures outbound traffic in real time and renders it as an animated node graph plus a world map:

Live node graph — every remote host your machine touches, glowing and moving
World map — geolocation of every endpoint, fully offline (MaxMind GeoLite2, no API calls)
Per-process attribution — not just "some connection to 142.250.x.x" but which app opened it
Anomaly detection — port scans, beaconing patterns, suspicious exfiltration volumes
Privacy score — a live rating of how chatty your system is, broken down by trackers/CDNs/normal traffic
Bilingual UI — English and French, switchable at runtime

Why another tool?

Little Snitch / Lulu — macOS-only (Lulu is free, Little Snitch is paid), firewall-centric
GlassWire — Windows-centric, freemium, phones home
Wireshark — the gold standard, but it's a protocol analyzer, not a dashboard; way too heavy to leave running

Some engineering choices

Own packet parser instead of Scapy — Scapy is GPL-incompatible with the license I wanted, so I wrote a minimal L2/L3/L4 decoder. Less code than integrating it.
Offline GeoIP — a bundled database beats a "free API" that dies in two years and leaks your traffic metadata to a third party.
Electron + React + FastAPI — desktop app, but the backend runs standalone too (uvicorn + any browser).
Demo mode — SNITCH_DEMO=1 injects synthetic traffic through the real pipeline so you can try it without root/pcap.

Try it

git clone https://github.com/aixisstudio/Snitch
# or one-click install via Pinokio, or Docker, or the Electron builds

Repo: https://github.com/aixisstudio/Snitch — AGPL-3.0. Stars, issues, and PRs welcome. There are a few good first issue tickets open if you want to get involved.

Curious what you'd find on your own machine. Honest feedback welcome — especially on the anomaly heuristics.