Little Snitch for Linux
- title
- Little Snitch for Linux
- type
- toolbox
- summary
- Linux port of the per-app network monitor — eBPF connection tracking with a web UI for blocking
- tags
- linux, networking, privacy, ebpf, firewall
- language
- C/Go
- license
- GPLv2 (eBPF + web UI), proprietary (daemon)
- created
- 2026-04-09
- updated
- 2026-05-06
The Linux port of Objective Development's Little Snitch, a per-application network monitor. It watches which processes connect to which servers, shows traffic history and data volumes, and lets you block connections with one click. The interface is a web UI served at localhost:3031, installable as a PWA.
How it works
An eBPF program hooks into the kernel's networking stack to observe outgoing connections and attribute them to processes. It forwards events to a userspace daemon that evaluates rules, tracks statistics, and serves the web UI. This is similar in spirit to what hazmat does for AI coding agents (constraining network access), but Little Snitch is interactive and general-purpose rather than policy-driven containment.
Requires Linux kernel 6.12+ with BTF (BPF Type Format) support. The eBPF constraint matters: under heavy traffic, the in-kernel cache tables can overflow, breaking packet-to-process attribution and DNS name reconstruction. The project is explicit that it's "built for privacy, not security" — good for understanding what your software does, not for hardening against determined adversaries.
Rules and blocklists
Custom rules can target specific processes, ports, and protocols. Blocklists support hosts-style files, one-domain-per-line, and CIDR ranges. No regex or glob patterns. Compatible with Hagezi, Peter Lowe, Steven Black, and oisd.nl lists. The macOS .lsrules format is not supported.
Default behavior is allow-all; unmatched connections pass through. You can flip this to deny-all in main.toml for an allowlist approach.
Configuration
Config lives in /var/lib/littlesnitch/config/. Customizations go in /var/lib/littlesnitch/overrides/config/ to survive updates. Key files: web_ui.toml (address, port, TLS, auth), main.toml (default allow/deny), executables.toml (process grouping heuristics).
By default the web UI has no authentication — any local process can modify rules. Enable auth in web_ui.toml if running on a shared machine or if you're worried about malicious software disabling filters.
Licensing
The eBPF kernel program and web UI are GPLv2, source on GitHub. The daemon is proprietary but free to use and redistribute.
https://obdev.at/products/littlesnitch-linux/index.html
Related
- ebpf-sock-ops — the kernel-hook category for connection-level eBPF networking (different goals: gecit injects, Little Snitch observes)
- gecit — another eBPF-using tool, same kernel surface area, different purpose