picosnitch

Yep, and from my experience too (made a tool that monitors network traffic with eBPF [1]) in addition to those issues there is also a sizable latency hit. [1] https://github.com/elesiuta/picosnitch

Similar to bandwhich, I recently created a snap of my own bandwidth monitor, picosnitch [1]. However I was only able to get it working with classic confinement due to there being no snap interfaces for fanotify or BPF kfuncs. Unfortunately this meant it couldn't be published on the store. I already packaged it for nearly every distro, but unfortunately most don't have dash [2] in their repos so the user needs to install it separately, and I was hoping that snap would be an easier solution for that. [1] https://github.com/elesiuta/picosnitch/blob/master/snap/snap... [2] https://repology.org/project/python:dash/versions

i'd like to mention https://github.com/elesiuta/picosnitch "Monitor network traffic per executable using BPF" ps not affiliated

> Something I often want to do is catch which process sent a few UDP packets. Catching short lived processes and packets is one of the things I specialized picosnitch [1] for, which focuses strictly on monitoring. [1] https://github.com/elesiuta/picosnitch

I wrote picosnitch [1] which has the same notification and bandwidth monitoring features, however it doesn't block traffic for a couple reasons: avoiding scope creep so I can focus on more reliable detection and do things like hash every executable, which makes it harder to block traffic in a timely fashion. https://github.com/elesiuta/picosnitch

It's picosnitch, if you know what I'm doing wrong/how to fix it that'd be great! It depends on bcc and psutil, and I am able to build and run it from a .nix file using python3.pkgs.fetchPypi with nix-build -E 'with import <nixpkgs> {}; callPackage ./picosnitch.nix {}' sudo -E ./result/bin/picosnitch start-no-daemon However, when I run it with just start, it can no longer find psutil and bcc. It uses a daemon class here [1]. I also encounter the same issue when running it without sudo, since it will re-execute itself here [2]. It can also use systemd, but I didn't get around to figuring out how to use systemd and install the service file on nix (I've never used nix before and know very little). [1] https://github.com/elesiuta/picosnitch/blob/master/picosnitc... [2] https://github.com/elesiuta/picosnitch/blob/master/picosnitc...

> Indeed. The proper thing (also read as: the friendliest way for distro packagers) is for software projects to generate and publish a tarball themselves as part of their tag+release process. And this is easy enough to do automatically with GitHub actions, I have a workflow [1] which runs on each release to create a stable archive of the source and attaches it to the release. [1] https://github.com/elesiuta/picosnitch/blob/master/.github/w...

I always anticipated something like this could happen and it bothered me enough to create my own workflow [1] to archive, hash, and attach it to each release automatically for my AUR package. I can see how most people wouldn't notice/bother with such a small detail though, so I am not at all surprised by the fallout this caused. [1] https://github.com/elesiuta/picosnitch/blob/master/.github/w...

> Linux is still dicey to correlate traffic with a particular app, especially if the connection is/was shortlived. This is has become a lot easier and more reliable to do now with BPF [0]. I also used the same approach to create a somewhat user-friendly TUI and web dashboard for it [1]. It is also able to hash the executable (even if it was shortlived). [0] https://www.gcardone.net/2020-07-31-per-process-bandwidth-mo... [1] https://github.com/elesiuta/picosnitch

picosnitch helps you protect your security and privacy by "snitching" on anything that connects to the internet, letting you know when, how much data was transferred, and to where. It uses BPF to monitor network traffic per application, and per parent to cover those that just call others. It also hashes every executable, and will complain if some mischievous program is giving it trouble.

I was curious how does session notification from system service works -- what if there is no one logged in? What if there are multiple users? How about ssh connections? The answer is as following: - user's dbus session is used for notifications. On systemd systems, user's dbus socket is in fixed, predictable location, and only depends on username. The script hardcodes this location. - The normal install procedure records the username of the user who called "install" command and uses their session for notification [0]. So if user "alice" run the install command, and user "john" is logged in, no notifications will be delivered. - If installer user is not available, an arbitrary user is chosen [1] (!) and program just expect them to be logged in. This happens when installing a .deb file for example. - If the user is not logged in, or has log