Snitch – A friendlier ss/netstat (github.com)

I always wondered how useful such tools are against a competent adversary. If you are a competent engineer designing malware, wouldn't you introduce a dormancy period into your malware executable and if possible only talk to C&C while the user is doing something that talks to other endpoints? Maybe even choose the communication protocol based on what the user is doing to blend in even better.

It looks nice, and I don't see anything wrong with it, but I've been using iptraf-ng since forever and I think it has a slight edge here.

Is it possible I've missed something from the demonstration video on that page?

When I saw this headline I assumed it was Little Snitch an existing network monitor and firewall for Macs.

Might need a different name.

https://www.obdev.at/products/littlesnitch/index.html

Nice! Couple of notes:

1. Can you highlight the currently selected row with a different background?

2. Maybe add optional reverse DNS lookups?

[dead]

The demo recording-as-code seems cool (in https://github.com/karol-broda/snitch/tree/master/demo)

I love the recent increase in TUI-based tooling. This looks cool - will check it out!

I just want a single tool that has a known, generalized set of capabilities on just about every distribution.

Systemd's obsession with remaking every single wheel in Linux has been aggravating enough. Please don't do it again.

prettyneat.gif

Thanks for sharing

I don't like the name but I like the TUI, connection monitoring is perfectly handled by a TUI!

I can't read as fast as your demo GIF. Just infuriating.

it's weird that both lsof and ss defaults are so awful

Like, ss without any options shows such arcane, rarely needed details as send/receive queue size but not the application socket belongs to.

And omits listening sockets which is main use for such tools.

I know picking the right defaults is hard ask but they managed to pick all the wrong defaults.

   (
   printf '/int state_filter = 0;/a\\\n'
   printf 'state_filter = (1 << SS_LISTEN) | (1 << SS_CLOSE);\\\n'
   printf 'show_processes++;\\\n'
   printf 'show_queues = 0;\\\n'
   echo
   echo "s/dhalBet/q&/"
   printf '/switch (ch) {/a\\\n'
   printf "case 'q':show_queues=1;break;\\\n"
   echo
   )|sed -i -f/dev/stdin misc/ss.c

One aspect of sysadminship that I find cute (but suboptimal) is how we memorize this strings of commands that were clearly not quite designed to be used in that manner. A slightly related example is how our intents in our mind end up having commands that don't resemble at all what we actually want, creating a map between intent and command that is almost exclusively arbitrary except for some obsucre etymological origin that might or might not help you remember the command in a time of need.

For example:

Intent: "create a file"

Command: "touch $FILE"

As it happens, touching a file doesn't mean to create, it was supposed to touch to modify the last access date, like a null op. But now if you want to create a file you do that.

Intent: "Print a file contents to screen" Command: "cat $FILE"

Is this a reference to a feline? some slang for printing or reading? No it's short for concatenate, but if you pass just one argument instead of 2, it prints the concatenation of 1 file and nothing.

Even something as simple as

Intent: "Rename a file" Command: "mv $FILE"

Of ocurse there's the fact that moving a file and renaming the file are very similar if not identical in most FS/OS, but also, the slight change from a word to a proper-name style command already creates a style of command line interaction that was very natural in the 80s, but is now being reinvented with the advent of more powerful language decoding technology. So even:

Intent: "Copy a file" Command: "cp $FILE"

Now to the topic, you can see how my relationship with ss is the mapping:

Intent: "See a list of open ports" Command: "ss -tulnp"

Which I remember mnmemotecnically because it is close to -tulip. This is similar to ps -aux in that the command includes a set of options and I remember it mnemotecnically ("auxiliary" or "auxilio"), and I use the options even when I don't need them, modifying the options from that baseline if needed, like removing "a" to get just the current user's processes.

That said. I don't know if the future is going to be "better" alternatives to old tools, but rather deconstructing or making use of the concept of "binary":"command", running man and --help has never been an optimal solution, and let's be honest, kids nowadays are googling, stackoverflowing and chatgpting their intent in order to get a magical command.

No easy way to improve upon this at the userspace level, the OS model of delegating control to binaries based on a hierarchical command structure is sensible, and "magic", or sharing commands across binaries without a clear ruleset would be too opaque. But I feel that creating new tools while barely revolutionizing the way they work is too small an incremental change, it adds more noise, I'm not sure that ss2 or network-manager instead of wpa_supplicant is a better outcome, now you are just linearly increasing the cognitive demand of new sysadmins linearly with time.

Sorry to be a bummer.

When attempting to install through go:

    go install github.com/karol-broda/snitch@latest

I get this error message:

    go: github.com/karol-broda/snitch@latest: version constraints conflict:
     github.com/karol-broda/snitch@v0.1.8: parsing go.mod:
     module declares its path as: snitch
             but was required as: github.com/karol-broda/snitch

Name can be friendlier, tui looks nice!

Thanks for this! I can never remember the netstat arguments, and it's a bit crazy that it doesn't come with sane defaults, so this is going to be really useful.

The README doesn't mention this, but on macOS it's also available via brew:

`brew install snitch`

An old classic powerful network tool; Netwox (i.e. Network Toolbox with more than 200 tools) and Netwag (Tcl/Tk GUI) - https://ntwox.sourceforge.net/ and https://ntwag.sourceforge.net/

Howto Guide - https://anto.online/mastering-netwag-guide/

I wish there was a tool that also displayed current and accumulated transfer rate per socket/process. I use jnettop for this purpose, but I'm unhappy with its user interface.

I've gotten used to ss now, and I quite like it, I just wish there was an option to not show the send/recv numbers. I never use them and the width is already so wide that the output barely fits into most terminals when you have them split vertically on a laptop screen.

That said though, I'm not going to install snitch. The thing about ss is that it's already there, on every server I manage. And I definitely do not need a TUI for this.

Snitch is something you might install in your homelab, or your workstations. But ss is still the default when you provision a lot of servers.