Forgot your password?
Close
typodupeerror
Privacy Software Linux

Little Snitch Comes To Linux To Expose What Your Software Is Really Doing (nerds.xyz) 65

Posted by BeauHD from the visible-activity dept.
BrianFagioli writes: Little Snitch, the well known macOS tool that shows which applications are connecting to the internet, is now being developed for Linux. The developer says the project started after experimenting with Linux and realizing how strange it felt not knowing what connections the system was making. Existing tools like OpenSnitch and various command line utilities exist, but none provided the same simple experience of seeing which process is connecting where and blocking it with a click. The Linux version uses eBPF for kernel level traffic interception, with core components written in Rust and a web based interface that can even monitor remote Linux servers.

During testing on Ubuntu, the developer noticed the system was relatively quiet on the network. Over the course of a week, only nine system processes made internet connections. By comparison, macOS reportedly showed more than one hundred processes communicating externally. Applications behave similarly across platforms though. Launching Firefox immediately triggered telemetry and advertising related connections, while LibreOffice made no network connections at all during testing. The early release is meant primarily as a transparency tool to show what software is doing on the network rather than a hardened security firewall.

Little Snitch Comes To Linux To Expose What Your Software Is Really Doing More | Reply

Little Snitch Comes To Linux To Expose What Your Software Is Really Doing

Comments Filter:

  • lsof -i ? (Score:5, Informative)

    by Fly Swatter ( 30498 ) on Thursday April 09, 2026 @11:11AM (#66085216) Homepage
    I guess this will be logging that type of data, so another data logger.

    • Re:lsof -i ? (Score:4, Interesting)

      by nightflameauto ( 6607976 ) on Thursday April 09, 2026 @11:36AM (#66085270)

      I guess this will be logging that type of data, so another data logger.

      Combined with entries for whichever of the various firewall tools you may be using for the "one click to block" part. People like their visual tools. I'd prefer the command line myself, but I won't complain too much about somebody coming to Linux and creating their own utility right off the bat. Seems very in the right frame of mind at least.

    • Re: (Score:3, Interesting)

      by Anonymous Coward

      lsof -i won't catch short-lived connections the way eBPF will

    • Re:lsof -i ? (Score:4, Interesting)

      by tlhIngan ( 30335 ) <slashdot.worf@net> on Thursday April 09, 2026 @03:42PM (#66085790)

      I guess this will be logging that type of data, so another data logger.

      Little Snitch is not a data logger. It's a real time connection monitor.

      Let's say you're using an app, and it decides to make a random connection to some server. Little Snitch will immediately pop up a dialog asking what you want it to do - let the connection through, block the connection, and if you want to allow it always, block it always, etc.

      The fact it's immediate generally is for tracking purposes - the event happened because you clicked a button or started an app. A logger just makes an entry in the log, and it's really hard to correlate that log with user activity. Maybe you were running Audacity, and when you start it up, it makes a connection to the owner's server completely out of the blue. Maybe it's checking for an update. Maybe it's trying to upload your data to its servers. What you learn is that it happened when it was launching. With a data logger, you just get notified of it but have no way to figure out what you were doing at the time of the log entry.

      In this day and age of telemetry and such, having it show up immediately when an app tries to make the connection is far more useful than having to do rules of allow and deny lists and having no clue what's causing it. Knowing it was a specific app uploading all your personal information means you can choose to switch to something better, block the upload so you can continue to use the app, or some other thing.

    • Given the constant Sev 1 exploits published on a weekly basis, why aren't applications and third party system services, isolated by default so that they have limited access to the filesystem, internet connections, system tables, ....?

      • Because PCs have a different workload requirement and expectations of those using them.

        If you require hand holding because you have no idea how the thing works and have no desire to learn, go use a device that has those protections in place by default.

        If you need to run a workload that's incompatible with those protections, then either rewrite / redesign and then rewrite the workload to be compliant (hard / expensive), or use a device that doesn't have those protections and take appropriate precautions

        • Exhibit A: Windows Subsystem for Linux (API intercept and thunk layer)
          Exhibit B: Windows machine support for hypervisor

          Microsoft can require software vendors to restructure their applications to work in a sandbox and require those applications to not force an OS level system service used just to update the desktop application.

          It'd take a decade to get there (isolated binary folder, isolated data file folder, isolated registry, isolated firewall entries, ...) but progress towards that can be made.

          I'd expect

  • Or would that just be a firehose?
    Who watches the watchers?

  • Wireshark - ? (Score:4, Informative)

    by evil_aaronm ( 671521 ) on Thursday April 09, 2026 @11:27AM (#66085244)
    Isn't this what Wireshark is for? Or at least one of its many purposes?

    • Can you use Wireshark to block the specific traffic?

    • Re:Wireshark - ? (Score:5, Informative)

      by SumDog ( 466607 ) on Thursday April 09, 2026 @11:35AM (#66085268) Homepage Journal
      LittleSnitch (and I guess open snitch?) show you whenever a process attempts to make an outbound connection and lets you define a rule about if you want to allow it. It's not just a monitor, it actively forces you to approve or deny every program's connection to the Internet the first time you run it.

      • Interesting, GRC (Steve Gibson, IIRC) used to have something like that for Windows way back when.

        It was nice to be able to keep tabs on what apps were doing, but of course, it was a different era, one where you ran "programs" and they were mostly self-contained and offline.

        Nowadays you run a stripped-down web browser and everything you do is backed by some remote API or another.

      • Ok, this sounds pretty cool, and the easy-filtering makes it way more useful.

    • Isn't this what Wireshark is for? Or at least one of its many purposes?

      Or a hostlist. Where's that hostlist person on the slashdots when you need them?

      • Re: (Score:2)

        by Pascoea ( 968200 )
        Oh god, you're talking about the hosts-file guy? I forgot about them.

      • Re: (Score:2)

        by unrtst ( 777550 )

        Isn't this what Wireshark is for? Or at least one of its many purposes?

        Or a hostlist. Where's that hostlist person on the slashdots when you need them?

        A hosts file can't differentiate between traffic from process A going to destination A and traffic from process B going to destination A, but things like Little Snitch can. IE: you could allow Pine to reach your mail server while blocking Mutt from reaching the same mail server.

      • What exactly does Littlesnitch accomplish that pihole or piVPN does not accomplish? The latter are free, open-source code.

    • Re: (Score:2)

      by Pascoea ( 968200 )

      Isn't this what Wireshark is for?

      To be fair, the answer for me would be "yeah, but."

      I've used Wireshark a couple of times for various tasks. I, personally, found it incredibly useful but the learning curve to be fairly steep. The sheer amount of data generated is overwhelming, especially if the only question I care about is "what is talking to who". I don't care what they are talking about, I just want to know who.

      The short version: Sometimes a simpler specific tool is better. I know I could answer that question with wireshark, but th

    • Re: (Score:2)

      by zlives ( 2009072 )

      maybe you are thinking of hostfiles... haven't seen that dude in a while

    • It's really nice software. You don't just get a visualization of current connections, you can get popup of new notifications AND the option to set up incoming/outgoing rules. Something like "Firefox is attempting to access slashdot.org port 443:

      Allow Once
      Allow Firefox to connect to slashdot.org port 443 any time
      Allow Firefox to connect to any server port 443 any time
      Allow Firefox to connect to any server, any port any time
      Deny Firefox all connections

      When I got my first Mac laptop, around 2004, Little Snitch

  • Eww (Score:2)

    by liqu1d ( 4349325 )
    Just seems like an ad pretending to be a story. There's already ways of finding this out.

    • Yeah, but that's basically every news story.

      There is an entire ice berg worth of decision making and financial incentives behind every story.

    • Ways exist, but not as clean-cut/easy as this ZONE-ALARM work-alike. Long overdue for Linux systems.

    • Re: (Score:2)

      by ack154 ( 591432 )

      Just seems like an ad pretending to be a story. There's already ways of finding this out.

      This guy submits all of his own stories just spamming his own website and they keep getting posted. So it may not directly be an ad for this Little Snitch, but it's definitely "nerds.xyz" spam.

  • Used to use Norton for this (Score:3)

    by AndrewZX ( 9173721 ) on Thursday April 09, 2026 @11:58AM (#66085328)
    In the dial up era Norton utilities would track and optionally block apps connecting to the internet. This was for Windows.

  • I'm looking forward to using this. The subject wasn't even on my radar - to my eternal shame - but now that it is I'm happy about the opportunit to lock down my laptop.

  • I like to keep an eye on my network exposure.

  • On the same note, it would be nice to have a tool (preferably integrated into explorer and the task manager) on Windows that tells you which process locked a given file and vica versa.

    • Look things up a bit: Power Toys/Locksmith can do this but this should be a built-in feature not some addon.

    • Re: (Score:2)

      by pjt33 ( 739471 )

      Process Explorer [microsoft.com]. Not quite as integrated as you'd like, but it lets you search for any handle, including part of a filename, to see which process(es) are holding it.

  • Unix (that includes Linux and obviously Macs) have a command called "lsof".
    "ls" is short for list and "of" is for "open files. List open files.

    A port is considered a file, and depending how the device tree mapping to names works, they are also in the device tree.

    The output might be overwhelming, but if you only want to see open ports and do not care about extra firewall features and user interaction, then lsof might be enough, especially considering the many command line options.

    • It's really not the same thing. See my other post https://linux.slashdot.org/comments.pl?sid=23961458&cid=66085502 [slashdot.org]

      I don't know how it will work with all the different firewalling options, etc., with Linux, but that's what makes it special for macOS (which comes with lsof, tcpdump, etc.)

    • Re: (Score:2)

      by unrtst ( 777550 )

      lsof is point in time, not monitoring.

      Let's say you keep seeing an intrusion attempt on your NAS from your laptop. You run lsof on your laptop, but don't see anything connecting to the NAS. You can keep running it every 10 seconds and never see it, while something could be making very short lived connection attempts that you're missing.

      Personally, for something like that, I just add some firewall rules to log only and watch the counts on them or check the log records. But that's also after the fact, and req

      • Good points.

        Any idea how LittleSnitch works? I would assume via DTrace?

        • Re: (Score:2)

          by unrtst ( 777550 )

          Good points.

          Any idea how LittleSnitch works? I would assume via DTrace?

          From TFS:
          "The Linux version uses eBPF for kernel level traffic interception, with core components written in Rust and a web based interface that can even monitor remote Linux servers."

    • Re: (Score:3)

      by higuita ( 129722 )

      think this as wireshark and lsof/netstat/ss had a child

      it sniff network traffic via the kernel, show what connections open and close and log them per PID ... finally, show that in a nice web interface

      So wireshark without dumping ALL the traffic payload, that can identify to what PID it belongs and all in real time, something lsof/netstat/ss can only show in THAT exact moment, not during time (so fail to detect short live requests)

  • iOS doesn't have an option to block wifi connections for apps. Only cellular. :(

  • Okay, so...

    Back in the day, on Windows... 98 through to about 7? I used to use ZoneAlarm on my Windows machines.

    Was that because we didn't have a network firewall at home? No. We did. In fact, I used to do quite a bit with Freesco (a single-floppy Linux router distro, designed to replace Cisco routers with commodity PCs). Our networking was DAMN good for a home network.

    But I liked to use it because it would POP UP and tell you something was using the Internet. What port. To what domain/IP. That it w

  • What about services that access the internet on behalf of other applications? If you use systemd-resolved, like many modern distributions, all applications will connect to the local service to perform DNS lookups. On older systems you might find nscd doing the same, although the reason and method are different.

    To which process does Little Snitch map these requests?

  • As far as userland software firewalls go, Little Snitch is pretty awesome. It has a very neat approachable shiny clicky UI and comes with a ton of useful and very easily accessible features. It's often used by mac users to prevent software from phoning home, but it has a slew of other tracking and logging features. To be honest, I wouldn't mind dropping a few bucks for this sort of thing, even if Linux is likely to have some tool that works in a similar fashion but requires CLI skills and lacks a neat UI. A

Slashdot Top Deals

"Unibus timeout fatal trap program lost sorry" - An error message printed by DEC's RSTS operating system for the PDP-11

Close