Linux Network Activity Monitor like Little Snitch

Post Views: 10

Little Snitch for Linux Offers Real-time Visibility into Outbound Connections

The Austrian company behind the popular macOS firewall utility Little Snitch, Objective Development, has recently released a Linux version of the tool.

This development addresses a long-standing gap in network monitoring capabilities for Linux users who require per-process visibility into outgoing connections.
The Linux version of Little Snitch leverages eBPF (Extended Berkeley Packet Filter) for traffic interception, operating at the kernel level and offering improved portability compared to kernel extensions.
The primary backend is written in Rust, while the user interface is a web application, enabling remote monitoring from any device, including a Mac.

“Several server applications have been listed as potential use cases for this capability, including Nextcloud, Home Assistant, and Zammad.”

Notably, the kernel component and user interface are open-sourced, allowing users to review the implementation, fix bugs, or adapt it to different kernel versions.

However, the backend, responsible for managing rules, block lists, and the connection view hierarchy, remains closed-source.

Feature Perspective

From a feature perspective, Little Snitch for Linux occupies a middle ground between the full-fledged Little Snitch and its stripped-down variant, Little Snitch Mini.

While it provides essential functionality, it lacks the polish and depth of the macOS version, which the company describes as an “honest first version.”

“The tool is primarily intended to demonstrate which legitimate software is making connections and permit users to block these connections when necessary, rather than preventing malicious activity.”

Compatibility

Compatibility-wise, the release is confirmed to work on kernel 6.12 and higher versions.

However, on older kernels, the tool hits the eBPF verifier’s maximum instruction limit. Although the company aims to achieve compatibility down to kernel 5.17, where the bpf_loop() function was introduced, further developer contributions are required to close this gap.

Little Snitch for Linux is available on GitHub for interested developers to explore and contribute to its development.