Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snitch – A friendlier ss/netstat

github.com

Post reply on HN
Print view View original

101–109 of 109 posts

Re: Snitch – A friendlier ss/netstat

#101

Post by rramadass »

karol-broda wrote: post #83
rramadass wrote: post #72

An old classic powerful network tool; Netwox (i.e. Network Toolbox with more than 200 tools) and Netwag (Tcl/Tk GUI) - https://ntwox.sourceforge.net/ and https://ntwag.sourceforge.net/ Howto Guide - https://anto.online/mastering-netwag-guide/

this is supposed to be an actually maintained terminal utility for viewing ss/netstat data

I was just pointing to another network tool used for all sorts of fine-grained networking jobs (eg. security testing and others) which might be helpful to others.

It was created by Laurent Constantin (https://linuxsecurity.com/features/introduction-to-netwox-an...) for his own needs and hence the TUI/GUI is not polished. But it is simple, direct and gets the job done which is what is important. And it is a mature tool (hence no need for active maintenance) available in all Linux distros.

Re: Snitch – A friendlier ss/netstat

#102

Post by teruakohatu »

hwj wrote: post #68
teruakohatu wrote: post #46

Earlier quoted context omitted.

Why did you switch? Price? OSS? Or does LuLu have compelling features?

It's a mix of everything (in no particular order): - the author of LuLu is a security researcher; he also wrote "The Art of Mac Malware" - I already bought two versions of Little Snitch and wasn't willing to pay for the third one - contacting their support left a bitter aftertaste

> - I already bought two versions of Little Snitch and wasn't willing to pay for the third one

I have probably also paid for three versions. It’s a great piece of software and they do not require upgrades excessively.

But I will try LuLu. I would rather my security software was OSS.

Re: Snitch – A friendlier ss/netstat

#103

Post by hwj »

karol-broda wrote: post #82
hwj wrote: post #69

The README doesn't mention this, but on macOS it's also available via brew: `brew install snitch`

dont think this is in homebrew/core, brew install snitch may be a different package, could you paste brew info snitch output? if its not this project, i will add a note to the readme to avoid confusion. but i will be creating a homebrew cask soon

  $ brew info snitch
  ==> snitch: stable 0.1.8 (bottled), HEAD
  Prettier way to inspect network connections
  https://github.com/karol-broda/snitch
  Installed
  /opt/homebrew/Cellar/snitch/0.1.8 (9 files, 8.4MB) \*
    Poured from bottle using the formulae.brew.sh API on 2025-12-23 at 15:32:41
  From: https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/s/snitch.rb
  License: MIT
  ==> Dependencies
  Build: go 
  ==> Options
  --HEAD
          Install HEAD version

Re: Snitch – A friendlier ss/netstat

#104

Post by pdimitar »

karol-broda wrote: post #80
pdimitar wrote: post #53

When attempting to install through go: go install github.com/karol-broda/snitch@latest I get this error message: go: github.com/karol-broda/snitch@latest: version constraints conflict: github.com/karol-broda/snitch@v0.1.8: parsing go.mod: module declares its path as: snitch but was required as: github.com/karol-broda/snitch

i fixed it and created a release so building from @latest should work now

It is indeed fixed now. Thank you!

Re: Snitch – A friendlier ss/netstat

#105

Post by matheuzsec »

gus_ wrote: post #76
jcgl wrote: post #61

Earlier quoted context omitted.

What makes ss different? In any case, interesting to think of shared libraries (specifically shared libc) as a risk here. Makes sense, but I hadn't thought about it before. That said, I'm having a hard time doing a threat model where you worry about an attacker only setting LD_PRELOAD but not modifying PATH. The latter is more general and can screw you with all programs (doesn't cover shell builtins, but it's not lik…

ss obtains the connections information via netlink directly from the kernel (besides parsing /proc): https://manpages.debian.org/bookworm/manpages/sock_diag.7.en... https://github.com/vishvananda/netlink/blob/main/inet_diag.g... Not many rootkits tamper the netlink channel, so in most cases it's a bit more reliable.

Nowadays, there's only one rootkit that can hide itself so perfectly: the Singularity rootkit. It also hides from auditd by using netlink_unicast hooking and other evasive functionalities. Analyzing a machine compromised with Singularity loaded is a real headache, since it prevents memory dumps for analysis.

https://github.com/MatheuZSecurity/Singularity

Re: Snitch – A friendlier ss/netstat

#106

Post by 1vuio0pswjnm7 »

PunchyHamster wrote: post #29

it's weird that both lsof and ss defaults are so awful Like, ss without any options shows such arcane, rarely needed details as send/receive queue size but not the application socket belongs to . And omits listening sockets which is main use for such tools. I know picking the right defaults is hard ask but they managed to pick all the wrong defaults.

"Like, ss without any options shows such arcane, rarely needed details as send/receive queue size but not the application socket belongs to.

And omits listening sockets which is main use for such tools."

IMHO this would be one of the many arguments in favor of compiling from source rather than using "binary packages"^1

https://mirrors.edge.kernel.org/pub/linux/utils/net/iproute2...

   (
   printf '/int state_filter = 0;/a\\\n'
   printf 'state_filter = (1
This changes the default to display all sockets, hide the queues and show the processes using each socket

It also adds adds a -q option to display the queues

1. IMHO this is also an argument against "cloud computing", i.e., using someone else's computers where pre-installed kernels and binary packages are the norm

Re: Snitch – A friendlier ss/netstat

#107

Post by petepete »

fn-mote wrote: post #58
petepete wrote: post #30

Earlier quoted context omitted.

I think the same applies for many of the new breed of command line applications like fd and ag/rg. Being able to use them intuitively trumps ubiquity, speed or features.

Very curious what is wrong about the rg defaults. The only one I change is to add `--no-ignore`.

Nothing.

fd, rg and ag all work how I expect them to work and the arguments and order fit in with my expectations for modern cli applications.

They're recursive, they ignore things I don't care about and I can just give them the string I'm looking for, no path, no -name or --recursive etc.

find and grep do similar things but work entirely differently and their args aren't even in the same format.

Re: Snitch – A friendlier ss/netstat

#108

Post by poemxo »

karol-broda wrote: post #96
poemxo wrote: post #21

I don't like the name but I like the TUI, connection monitoring is perfectly handled by a TUI!

thanks, but what don’t you like about the name?

Sorry for slow response. Snitch sounds like a tool that will do intercepting or alerting. Little Snitch is perfectly named in this regard. When it pops up prompting you for action, it feels like it just snitched on an app.

What you have here isn't a snitch, it's more like a full map of traffic. I don't have any other suggestions unfortunately.

Just my 2c

Re: Snitch – A friendlier ss/netstat

#109

Post by yencabulator »

PunchyHamster wrote: post #35
petepete wrote: post #30

Earlier quoted context omitted.

I think the same applies for many of the new breed of command line applications like fd and ag/rg. Being able to use them intuitively trumps ubiquity, speed or features.

But it's not tradeoff! You can make default view useful without trading versatility. Another annoying part is not supporting json or even CSV. Some tools got modernized with it (like iproute2 tool set), but for these you might as well do /proc scraping yourself...

ss is from the same batch of modernization as iproute2.
Post reply on HN