Snitch – A friendlier ss/netstat

Post by andrewmcwatters » Tue, Dec 23, 2025, 4:08 AM UTC

Post by aos » Tue, Dec 23, 2025, 4:51 AM UTC

Post by ashtakeaway » Tue, Dec 23, 2025, 5:27 AM UTC

karol-broda wrote: post #7

coppsilgold wrote: post #3

I always wondered how useful such tools are against a competent adversary. If you are a competent engineer designing malware, wouldn't you introduce a dormancy period into your malware executable and if possible only talk to C&C while the user is doing something that talks to other endpoints? Maybe even choose the communication protocol based on what the user is doing to blend in even better.

agreed on the limits. snitch isnt aimed at adversarial detection; its a local debugging/inspection tool. a competent attacker can blend in by design, so this isnt meant to be a standalone security control

Post by entrop » Tue, Dec 23, 2025, 6:18 AM UTC

tptacek wrote: post #5

coppsilgold wrote: post #3

I always wondered how useful such tools are against a competent adversary. If you are a competent engineer designing malware, wouldn't you introduce a dormancy period into your malware executable and if possible only talk to C&C while the user is doing something that talks to other endpoints? Maybe even choose the communication protocol based on what the user is doing to blend in even better.

Tools like these aren't really intended for adversarial environments, and pure network tools that are designed for real adversaries have a really spotty track record (good search: [bro vantage point problem]).

Post by Underphil » Tue, Dec 23, 2025, 6:35 AM UTC

rockskon wrote: post #14

I just want a single tool that has a known, generalized set of capabilities on just about every distribution. Systemd's obsession with remaking every single wheel in Linux has been aggravating enough. Please don't do it again.