How to Install and Use Sniffnet in Linux to Monitor Network Traffic in Real Time

Diagnosing sudden bandwidth spikes, identifying mystery outbound network connections, or inspecting network interface activity on Linux typically requires complex command-line packet analysers such as tcpdump, iftop, or wireshark. While these legacy tools are technically powerful, deciphering raw terminal text streams, setting up capture filters, or running bloated graphical interfaces over remote SSH sessions can slow down troubleshooting during network incidents. Sniffnet is a modern, cross-platform network traffic monitor written in Rust that provides intuitive, real-time packet inspection and bandwidth visualisation.

Designed with a focus on multithreaded performance and visual clarity, Sniffnet transforms raw network packet streams into understandable metrics. It categorises network traffic by highest throughput, protocol types, geographical country of origin, remote IP addresses, and domain names. Whether you run Sniffnet in a headless Linux server environment or on an Ubuntu workstation, it offers both terminal-level clarity and exportable PCAP reports. In this guide, you will learn how to install Sniffnet on Linux, grant packet capture capabilities, inspect real-time network traffic, and configure custom notifications for suspicious connection thresholds.

Why Use Sniffnet on Linux?

Sniffnet bridges the gap between low-level packet sniffers and high-level system monitors:

• Real-Time Bandwidth Graphs: Visualise live incoming and outgoing traffic rates (megabytes per second) alongside cumulative transfer totals.
• Country and Domain Resolution: Automatically resolves remote IP addresses into human-readable domain names and maps host countries using offline GeoIP databases.
• Multi-Protocol Inspection: Filter traffic across network layers including IPv4, IPv6, TCP, UDP, and application protocols such as HTTP, DNS, TLS, and SSH.
• Custom Threshold Alerts: Configure audio or visual alarms when bandwidth limits are exceeded or when connections to designated IP subnets occur.
• Native Rust Performance: Processes thousands of packets per second with minimal CPU and memory overhead, powered by the libpcap capture backend.

Installing Sniffnet on Linux

Sniffnet requires the standard packet capture development library (libpcap) installed on your host system before execution:

Step 1: Install Required System Dependencies

Install libpcap and essential build utilities via your distribution’s package manager:

• Ubuntu / Debian:

  sudo apt update && sudo apt install -y libpcap-dev libasound2-dev

• Fedora:

  sudo dnf install -y libpcap-devel alsa-lib-devel

• Arch Linux:

  sudo pacman -S libpcap alsa-lib

Step 2: Installing Sniffnet

Choose your preferred installation method:

Method A: Installing via Cargo (Recommended)

If you have Rust and Cargo installed:

cargo install sniffnet

Method B: Installing via Debian Package

Download the pre-compiled .deb package from the official Sniffnet GitHub releases page:

curl -LO https://github.com/GyulyVGC/sniffnet/releases/latest/download/sniffnet_Linux_amd64.deb
sudo dpkg -i sniffnet_Linux_amd64.deb

Method C: Installing on Arch Linux

yay -S sniffnet

Granting Packet Capture Permissions

By default on Linux, capturing raw network interface packets requires elevated privileges. Rather than running the entire application as root, grant network capture capabilities directly to the Sniffnet executable using setcap:

sudo setcap 'cap_net_raw,cap_net_admin=eip' $(which sniffnet)

This allows your normal unprivileged user account to capture packets safely without compromising system security.

Monitoring Network Traffic with Sniffnet

Once permissions are configured, launch Sniffnet from your application menu or terminal:

sniffnet

1. Selecting the Network Interface

1. Upon launch, Sniffnet presents an interface selection screen displaying all available network adapters (such as eth0, enp3s0, or wlan0).
2. Identify your active interface by looking at the real-time packet activity counter displayed next to each adapter name.
3. Select your active adapter and click Start.

2. Navigating the Real-Time Traffic Overview

The main monitoring dashboard organises traffic into clear analytical sections:

• Bandwidth Gauge: Displays current download and upload speeds along with total data transferred during the active session.
• Protocol Breakdown: Shows the proportion of TCP vs UDP packets and application-layer protocols (DNS, HTTPS).
• Top Connections: Lists active remote endpoints sorted by bytes exchanged, accompanied by the country flag and resolved domain name.

Filtering Traffic and Inspecting Connections

Sniffnet includes robust search and filtering tools to isolate specific hosts or traffic patterns:

Filter Category	Description & Use Case
IP Version	Toggle between IPv4, IPv6, or dual-stack viewing to detect legacy protocol leaks.
Transport Protocol	Isolate TCP streams to debug web connections or UDP streams to inspect VoIP and video calls.
Application Filter	Filter specifically for DNS (Port 53) to spot excessive background domain lookups.
Country Filter	Restrict monitoring to external international connections to audit cross-border server calls.

Exporting Capture Reports

When investigating a network bottleneck or security issue, Sniffnet allows you to export session data:

1. Click the Inspect tab to view individual connection threads.
2. Select any remote host to view its complete port assignment, timestamp history, and packet count.
3. Click the Export (PCAP / Text) button to generate a structured report or standard PCAP file suitable for in-depth packet dissection in Wireshark.

Tips for Efficient Linux Network Auditing

To maximize your monitoring efficiency with Sniffnet:

• Identify Suspicious Telemetry: Keep Sniffnet running on an idle workstation; any sudden outbound spikes immediately highlight background software updaters or telemetry daemons.
• Diagnose Local Network Congestion: Sort by transfer rate during large file backups to determine whether local NAS syncs or cloud storage clients are saturating your LAN interface.
• Run in Headless Servers: Use the dedicated command-line mode or pipe exported metrics into log analysers for automated remote server oversight.