A free, open-source Little Snitch alternative for Linux

Description and use

Snitch is a Linux network visualizer that shows which applications are connecting to which servers, with geolocation, history, and anomaly detection, without blocking traffic.

Problem

Linux users need a tool that shows which applications are communicating with which servers and whether that is expected, without requiring a full packet capture or firewall.

Outcome

Snitch delivers a comprehensive, privacy‑respecting dashboard that lets Linux users see what their machine is doing in real time, with historical persistence and anomaly detection, complementing OpenSnitch’s firewall capabilities.

Workflow

• 1. Install Snitch via Docker with host networking or run the release binary requiring root/cap_net_raw.
• 2. Start the backend; it binds to 127.0.0.1 and serves a local API.
• 3. Open the printed URL in a browser to view the dashboard.
• 4. (Optional) Enable demo mode with SNITCH_DEMO=1 to see synthetic traffic before granting capture rights.
• 5. Use the UI to explore live connections, view geolocation, anomaly alerts, and historical data.

Evidence

Snitch gives you a live world map of every outbound connection, with process attribution — which app opened it, not just which IP

Source

The API binds to 127.0.0.1 and requires a token. There is no telemetry, no account, no outbound call at all except an explicitly consent-gated GeoIP database download.

Source

docker run --network host ghcr.io/aixisstudio/snitch # or the release tarball — needs root/cap_net_raw like tcpdump

Source