// the find
GyulyVGC/sniffnet
Comfortably monitor your Internet traffic 🕵️♂️
Sniffnet is a cross-platform GUI network monitor written in Rust using the iced toolkit. It captures packets via pcap, shows real-time traffic charts, geolocates remote hosts, identifies protocols/services, and can alert on custom thresholds. Aimed at everyday users who want to see what their machine is talking to, not at power users doing deep packet inspection.
- Genuinely polished UI for a Rust/iced app — custom themes, thumbnail mode, and 25+ language translations show sustained maintenance effort beyond a weekend project.
- Ships pre-built binaries for an impressive matrix: Windows x64/arm64/x86, macOS Intel/Apple Silicon, Linux AppImage/DEB/RPM across amd64/arm64/i386/armhf. Most network tools make you compile yourself.
- Bundles MaxMind GeoLite2 databases directly in the repo and has an offline service/protocol lookup covering 6000+ entries — no mandatory cloud calls for core functionality.
- Has a published security audit, a THREAT_MODEL.md, and INCIDENT_RESPONSE.md — unusual level of security documentation for a solo/small-team open source tool.
- It's a traffic observer, not an analyzer — you can't reconstruct streams, decode TLS (obviously), or do anything resembling Wireshark's dissector depth. The PCAP export helps, but the in-app inspection is shallow.
- Process-to-connection attribution (which program owns a socket) works differently per OS and is inherently racy; on Linux it requires /proc polling and can miss short-lived connections entirely. The drawio diagram in the repo hints this is already a known pain point.
- Built on iced, which is still pre-1.0 and has a history of breaking API changes between releases — anyone wanting to fork or contribute faces a moving-target GUI framework dependency.
- No headless/daemon mode or machine-readable output (JSON/CSV stream, prometheus metrics, etc.), so it can't be used in monitoring pipelines or on servers without a display, which limits its usefulness beyond desktop curiosity.