What is Sniffnet?
Sniffnet watches what your Mac sends and receives over the network. It reads traffic from a network adapter you choose, draws live charts of how much is moving, and then explains what that traffic is: which programs are using the bandwidth, which remote hosts are involved, where those hosts are, and which of more than six thousand known services, protocols, trojans and worms a connection matches. It is aimed at people who find packet analysers intimidating — the project lists ease of use as one of its cornerstones — and it ships in 26 languages. It observes rather than blocks: it can highlight a connection that matches an IP blacklist you import, but it is not a firewall.
Verified product facts
- Type
- network monitorEditorially reviewed
- Platform
- macOS
- Apple Silicon
- Yes
- Pricing
- Open sourceDeveloper-stated
- Open source
- Yes
- Developer
- Giuliano BelliniDeveloper-stated
- Relationship to Nuanyue
- Third-party product — not published by NuanyueEditorially reviewed
- Licence
- MIT OR Apache-2.0
- Current version
- 1.5.1Developer-stated
- Official website
- sniffnet.app/
Last updated . Facts marked developer-stated come from the developer and are not independently confirmed; editorially reviewed marks a Nuanyue judgement.
Key features
What Sniffnet does at a glance.
Choose
Network adapter to inspect
Filters
Narrow the traffic being observed
Import and export capture reports as PCAP files
Overall statistics
For your internet traffic
Real-time charts of traffic intensity
Identification of connections
Inside the local network
Geographic location of remote hosts
Domain name and ASN lookup
For the hosts you exchange traffic with
Recognition of more than 6000 upper-layer services, protocols, trojans and worms
A per-program view of which applications are
Using network bandwidth
Favourites
For network hosts, services and programs
Keeps watching the network while the window is minimised
Real-time search and inspection of each connection
Custom notifications triggered
By defined network events
Custom IP blacklists
Highlight potentially dangerous connections
Themes
Including support for custom themes
Interface translated
Into 26 languages
Written entirely in Rust
What you can use Sniffnet for
- Finding out which application is saturating your connection
- Seeing which countries and organisations your machine is exchanging data with
- Checking whether any connection matches an address on a malicious-IP list
- Capturing traffic to a PCAP file so another tool can analyse it later
Who is Sniffnet for?
- Mac users who want to see what their network is doing without learning a packet analyser
- Anyone who prefers an open-source tool they can read, build and audit themselves
Who is Sniffnet not for?
- Anyone who needs to block or filter traffic — Sniffnet observes connections, it does not control them
- Users who need field-by-field dissection of individual packets, which is what a protocol analyser is for
Limitations
- It monitors traffic rather than controlling it; it is not a firewall and cannot stop a connection being made
- Reading a network adapter on macOS requires running the application with administrator privileges
- It summarises traffic rather than dissecting packets field by field, so it does not replace a protocol analyser
- The minimum macOS version for the current release is not stated in the sources Nuanyue tracks
Strengths and trade-offs
What Sniffnet does well, and what to weigh before choosing it. Points marked developer-stated come from the developer’s own material and have not been independently confirmed.
Strengths
- Recognises more than 6000 upper-layer services, protocols, trojans and worms, so a connection can be named rather than shown as a bare address.Developer-stated
- Shows which programs are using network bandwidth, which answers the usual 'what is eating my connection' question directly.Developer-stated
- Resolves the domain name, ASN and geographic location of the hosts you are exchanging traffic with.Developer-stated
- Imports custom IP blacklists to highlight potentially dangerous connections.Developer-stated
- Imports and exports capture reports as PCAP files, so traffic can be handed to another analyser.Developer-stated
- Free and open source, dual-licensed under MIT or Apache-2.0, with the full source published on GitHub.
- Runs on macOS without installing any extra system dependencies, unlike the Windows and Linux builds.
- Publishes a separate Apple silicon disk image alongside the Intel one for every release.
- The interface is translated into 26 languages by native speakers.
Trade-offs
- Observes traffic but cannot block it; the IP blacklist highlights a suspicious connection rather than preventing it.Derived
- Analysing a network adapter on macOS requires running the application with administrator privileges.
- Summarises traffic rather than dissecting individual packets field by field, so it does not replace a protocol analyser such as Wireshark.Derived
- The minimum macOS version is not stated in the sources Nuanyue tracks, so the oldest supported release is unknown.Editorially reviewed
First-use experience
What the app asks of you when you set it up. Only established facts appear here; anything we could not confirm is left out rather than guessed at.
- Installation
- Downloaded as a disk image from the project's GitHub releases, with separate builds published for Apple silicon and Intel.
- First launch
- On macOS the application has to be run with administrator privileges, because reading a network adapter requires them; there is no account, licence key or sign-in.
- System integration Developer-stated
- You pick a network adapter to inspect and Sniffnet reads traffic from it, while also identifying devices on the local network and continuing to watch while minimised.
- Apple Silicon
- Supported
What it does
Sniffnet reads the traffic flowing through a network adapter you choose and turns it into something you can look at. The overview page shows how much is moving in each direction and draws charts of traffic intensity in real time; the inspect page lists individual connections and lets you search them as they appear. That much a bandwidth meter would also do.
What Sniffnet adds is context for each connection. It resolves the remote host’s domain name and autonomous system number, looks up where that host is, and matches the connection against a bundled database of more than six thousand upper-layer services, protocols, trojans and worms, so a row that would otherwise be a bare IP address can be labelled as what it probably is. It also breaks the total down by program, which is the view most people actually want first: which application is using the connection.
Built for people who are not packet analysts
The project is explicit that its focus is user experience, on the grounds that most network analysers are hard to understand. The result is closer to a dashboard than to a console: charts, a sortable list of connections, favourites you can pin, notifications when a defined network event happens, and a choice of themes. It is translated into 26 languages by native speakers and written in Rust, and it is free and open source under a dual MIT or Apache-2.0 licence.
If you do need depth later, the capture can be exported as a PCAP file and opened in a tool built for protocol analysis. That is the intended division of labour rather than a missing feature.
What it is not
Sniffnet is a monitor, not a firewall. Every capability it advertises is observational: it shows, names, charts and notifies. The IP blacklist feature highlights a connection that matches a known-bad address — it does not drop it. If your goal is to decide which applications may connect out, that is a different class of tool.
On macOS the application also has to run with administrator privileges, because reading a network adapter requires them. This is a consequence of how packet capture works rather than a design choice, but it is worth knowing before you install: the app runs with more authority than an ordinary one. Against that, macOS needs no extra dependencies at all, where the Windows build requires Npcap and the Linux build needs libpcap and network capabilities.
Questions about Sniffnet
How much does Sniffnet cost?
Nothing. It is free and open-source software, dual-licensed under MIT or Apache-2.0. There is no paid tier and no account; the project asks for sponsorship through GitHub Sponsors to fund its continued development instead of charging for the application.
Does Sniffnet run on Apple silicon Macs?
Yes. The project publishes a separate Apple silicon disk image alongside the Intel build for every release, so there is a native download for M-series Macs.
Can Sniffnet block a connection?
No. It is a monitoring tool: it shows what is happening and can highlight connections matching an IP blacklist you import, but it does not act as a firewall and cannot stop traffic from being sent.Derived
Does Sniffnet need extra dependencies on macOS?
No. The project's manual states that macOS natively has all the dependencies needed to build and run Sniffnet, unlike Windows which requires Npcap and Linux which needs libpcap. On macOS you do still have to run the application with administrator privileges to analyse a network adapter.
How does Sniffnet differ from Wireshark?
Sniffnet is built around being approachable: it presents live charts, per-program bandwidth and named hosts rather than raw packets. Wireshark is a protocol analyser that dissects individual packets in detail. Sniffnet can export PCAP files if you later need that depth, and the two are often used together.Derived
Similar apps
Related in purpose, but not a straight swap.
Wireshark
Open-source network protocol analyzer with deep packet inspection.
Both capture network traffic on a Mac, but Wireshark is a protocol analyser that dissects individual packets for experts while Sniffnet summarises traffic into charts, named hosts and per-program bandwidth for anyone.
Works well with
Not a replacement — apps commonly used alongside this one.
Little Snitch
Application firewall that approves or blocks every outgoing connection.
Little Snitch decides which connections the Mac is allowed to make, and Sniffnet shows what those connections are actually doing once they exist.
LuLu
Free open-source firewall for blocking outgoing connections on macOS.
Both are free and open-source network security tools for macOS, but LuLu blocks outbound connections while Sniffnet only observes and reports them.
Links
Sources
Facts on this page are checked against the sources below. Last updated .
