# Little Snitch for Linux

The Linux port of Objective Development's Little Snitch, a per-application network monitor. It watches which processes connect to which servers, shows traffic history and data volumes, and lets you block connections with one click. The interface is a web UI served at `localhost:3031`, installable as a PWA.

## How it works

An eBPF program hooks into the kernel's networking stack to observe outgoing connections and attribute them to processes. It forwards events to a userspace daemon that evaluates rules, tracks statistics, and serves the web UI. This is similar in spirit to what [[hazmat]] does for AI coding agents (constraining network access), but Little Snitch is interactive and general-purpose rather than policy-driven containment.

Requires Linux kernel 6.12+ with BTF (BPF Type Format) support. The eBPF constraint matters: under heavy traffic, the in-kernel cache tables can overflow, breaking packet-to-process attribution and DNS name reconstruction. The project is explicit that it's "built for privacy, not security" — good for understanding what your software does, not for hardening against determined adversaries.

## Rules and blocklists

Custom rules can target specific processes, ports, and protocols. Blocklists support hosts-style files, one-domain-per-line, and CIDR ranges. No regex or glob patterns. Compatible with Hagezi, Peter Lowe, Steven Black, and oisd.nl lists. The macOS `.lsrules` format is not supported.

Default behavior is allow-all; unmatched connections pass through. You can flip this to deny-all in `main.toml` for an allowlist approach.

## Configuration

Config lives in `/var/lib/littlesnitch/config/`. Customizations go in `/var/lib/littlesnitch/overrides/config/` to survive updates. Key files: `web_ui.toml` (address, port, TLS, auth), `main.toml` (default allow/deny), `executables.toml` (process grouping heuristics).

By default the web UI has no authentication — any local process can modify rules. Enable auth in `web_ui.toml` if running on a shared machine or if you're worried about malicious software disabling filters.

## Licensing

The eBPF kernel program and web UI are GPLv2, source on GitHub. The daemon is proprietary but free to use and redistribute.

https://obdev.at/products/littlesnitch-linux/index.html

## Related

- [[ebpf-sock-ops]] — the kernel-hook category for connection-level eBPF networking (different goals: gecit injects, Little Snitch observes)
- [[gecit]] — another eBPF-using tool, same kernel surface area, different purpose