Most traffic analysis on Linux happens in a terminal, usually with tcpdump or Wireshark. The Sniffnet network monitor takes a different approach. It gives you a clean graphical dashboard that shows what your machine is talking to, in real time, without asking you to learn a filter syntax first. The project sits at over 40,000 stars on GitHub, it is written in Rust, and it runs on Linux, Windows, and macOS. I keep it open on a second monitor when I want a quick answer to the question “why is my connection busy right now”.
This guide walks through seven steps: installing it, capturing traffic, filtering, inspecting connections, setting alerts, exporting data, and knowing when to reach for something else.
What the Sniffnet Network Monitor Shows You
After you pick a network adapter, the Sniffnet network monitor starts drawing two things. The first is a live chart of incoming and outgoing traffic, measured in bits or bytes per second. The second is a table of every connection your machine has open, with remote hosts resolved to domain names, countries, and autonomous system names.
That last part matters. Raw IP addresses tell you very little. Seeing “amazonaws.com, United States, AS16509” next to a connection tells you a lot more, and Sniffnet does the lookup locally against bundled MMDB databases, so nothing about your traffic leaves the machine.
1. Install Sniffnet on Linux
The Sniffnet GitHub repository publishes .deb and .rpm packages with every release. On Debian and Ubuntu:
wget https://github.com/GyulyVGC/sniffnet/releases/latest/download/Sniffnet_LinuxDEB_amd64.deb
sudo apt install ./Sniffnet_LinuxDEB_amd64.debIf you already have a Rust toolchain, cargo works too, though you need the capture and GUI build dependencies first:
sudo apt install libpcap-dev libasound2-dev libfontconfig1-dev libgtk-3-dev
cargo install sniffnetArch users can grab it from the AUR. There is also a Homebrew formula for macOS. The full list of options lives on the official Sniffnet site.
2. Grant Capture Permissions and Start
Packet capture needs raw socket access. Running the whole GUI as root is the lazy fix. The better fix is granting the binary the two capabilities it needs, once:
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/sniffnetSniffnet links against libpcap, the same capture library behind tcpdump, so anything visible to tcpdump is visible here. Launch the app, pick your adapter from the list (wlan0, eth0, or whatever ip link shows on your machine), and hit start. The chart begins moving within a second or two.
3. Filter Traffic in the Sniffnet Network Monitor
The filter panel sits on the start screen, before capture begins. You can narrow by IP version, by transport protocol (TCP or UDP), and by port or address ranges. Version 1.3 added a BPF-style filter field as well, so an expression like port 443 or host 192.168.1.50 works the way it does in tcpdump.
I usually start wide and filter later. The Sniffnet network monitor lets you click any column in the connections table to sort by bytes or packets, which often answers the question faster than a carefully built filter would.
4. Inspect Connections, Hostnames, and Services
The inspect page is where the Sniffnet network monitor earns its spot. Every row shows source, destination, resolved hostname, service guess, protocol, and running byte counts. Click a row and you get the full detail view, including the country flag and ASN of the remote end.
You can mark any connection as a favorite. Favorites get their own filter toggle, so you can watch just the three or four remote hosts you actually care about while everything else stays out of the way. For tracking one flaky host over time I still prefer a terminal graph, and I covered that workflow in the gping latency monitoring guide.
5. Set Notifications for Traffic Thresholds
The notifications tab takes thresholds for bytes per second and packets per second, plus an alert for activity on favorite connections. When a threshold trips, Sniffnet logs the event and can play a sound.
This turns the Sniffnet network monitor into a passive alarm. Set a bytes threshold slightly above your normal idle traffic, minimize the window, and you will hear about it when a backup job, an update daemon, or something less welcome starts moving data. It is not an IDS and does not pretend to be one, but as a “something is happening” tripwire it works well.
6. Export a PCAP and Read the Report
Since version 1.3 the Sniffnet network monitor can write captured packets straight to a PCAP file from the start screen. That file opens in Wireshark or tcpdump for deep inspection later. Sniffnet also produces a text report of the capture session with per-connection totals.
The split works nicely in practice: Sniffnet answers “what is happening” while capture-and-analyze tools answer “what exactly was in those packets”. When I need the packet-level view on a headless box, I go back to the command line, and my tcpdump troubleshooting guide covers that side.
7. When the Sniffnet Network Monitor Is the Wrong Tool
The Sniffnet network monitor needs a desktop session. On a remote server with no display, tcpdump, iftop, or nethogs remain the right answers. It also shows traffic per connection, not per process. If your actual question is “which PID is eating my bandwidth”, nethogs answers that directly and Sniffnet does not.
Payload inspection is out of scope too. Sniffnet reads headers, counts bytes, and resolves names. It will not show you HTTP requests or TLS handshake details. Export the PCAP and open Wireshark for that.
Why Keep the Sniffnet Network Monitor Around
Speed of answers. Opening Sniffnet and glancing at the chart takes ten seconds. Building the equivalent view from tcpdump output takes longer, every single time. The connection table with resolved hostnames catches things a byte counter never would, like a package mirror you forgot you configured or a chatty telemetry endpoint.
It also costs almost nothing to run. On my machine the process idles under 100 MB of RAM while capturing on a busy interface. For a GUI doing live charts and per-connection accounting, that is a fair price for the visibility you get back.