Repolode
Submit
aixisstudio

aixisstudio/Snitch

Real-time network traffic visualizer that shows every connection your computer makes, which app is responsible, and where the remote hosts are.

Open-source alternative to:Little SnitchGlassWire

View on GitHubWebsite
Stars
450
Forks
28
Open issues
1
Last commit
14 hours ago

What is it?

Snitch is a local network traffic visualizer. It captures the connections your computer opens and shows who they talk to, where the remote servers are located, and which process generates each flow. The interface offers a live force graph, a geolocated world map with animated arcs, and a sliding timeline of 15, 30 or 60 minutes.

The tool also flags suspicious patterns such as port scans, beaconing and possible data exfiltration, and it scores the privacy exposure of outgoing traffic. A passive LAN scanner builds a device list from the system ARP table without sending broadcast scans. Alerts can be suppressed by host or type, and suppression rules persist across restarts.

Snitch runs its API on 127.0.0.1 behind a per-launch token. Geolocation uses an offline DB-IP Lite database bundled with the project, and no telemetry is sent. Packet capture is built on libpcap or Npcap, and the backend is FastAPI with SQLite storage, a React and D3.js frontend, and an Electron wrapper for macOS and Windows. Linux is supported through Docker with host networking.

Key features

  • 01Live force graph of local connections, with each remote host as a node
  • 02Geolocated world map with animated connection arcs
  • 03Anomaly detection for port scans, beaconing and possible exfiltration
  • 04Process attribution showing which app generates each connection
  • 05Passive LAN device discovery from the system ARP table
  • 06Offline geolocation with no outbound lookups and no telemetry

Use cases

  • Checking which background applications are contacting remote servers on a laptop
  • Spotting unexpected outbound connections or data uploads from a workstation
  • Getting a readable overview of network activity without learning packet analysis tools
  • Reviewing devices on a home or small office LAN

Quick start

  1. 1

    Install on macOS (Apple Silicon) with Homebrew

    brew install --cask aixisstudio/tap/snitch
  2. 2

    Or run the Linux Docker build from the cloned repo

    sudo docker compose up --build
  3. 3

    Open the UI in your browser using the token printed in the logs

Things to know

  • Packet capture needs administrator or root privileges.
  • Docker Desktop on Mac and Windows cannot capture host traffic, so use the Electron app there.
  • The macOS build is Apple Silicon only and is ad-hoc signed, not notarized.
  • Windows capture requires installing Npcap separately.

Topics

#network-monitor#network-security#traffic-analysis#packet-capture#privacy#data-visualization#fastapi#react#bandwidth-monitor#cybersecurity

FAQ

What is Snitch?
Real-time network traffic visualizer that shows every connection your computer makes, which app is responsible, and where the remote hosts are. Snitch is a local network traffic visualizer. It captures the connections your computer opens and shows who they talk to, where the remote servers are located, and which process generates each flow. The interface offers a live force graph, a geolocated world map with animated arcs, and a sliding timeline of 15, 30 or 60 minutes.
Is Snitch free to use? What license does it have?
Snitch is open source under the AGPL-3.0 license. Check the license terms before using it in commercial products.
Is Snitch still maintained?
Actively maintained. The last commit to Snitch was on Oct 19, 2026.
What can I use Snitch for?
Checking which background applications are contacting remote servers on a laptop Spotting unexpected outbound connections or data uploads from a workstation Getting a readable overview of network activity without learning packet analysis tools Reviewing devices on a home or small office LAN
How do I install Snitch?
Install on macOS (Apple Silicon) with Homebrew: brew install --cask aixisstudio/tap/snitch Or run the Linux Docker build from the cloned repo: sudo docker compose up --build Open the UI in your browser using the token printed in the logs
Where can I get Snitch?
The source code and installation instructions are on GitHub: https://github.com/aixisstudio/Snitch

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects