<p>Objective Development, the team behind the popular macOS network monitor Little Snitch, has released a Linux version of the tool.</p>
<h2>Why they built it</h2>
<p>The stated motivation is a mix of practical and political: the developers were uncomfortable relying on foreign-controlled software for security tooling, and they couldn’t find a Linux firewall with a decent GUI that came close to what Little Snitch offers on macOS. So they built one.</p>
<p>As a side effect of the project, they ran an informal comparison between Ubuntu and macOS network behavior. Over one week, Ubuntu had 9 system processes making outbound connections. macOS had over 100. Make of that what you will.</p>
<h2>How it works</h2>
<p>The Linux version uses eBPF for kernel-level traffic interception and is written in Rust. The UI is web-based, which makes it practical for monitoring remote servers — not just desktops.</p>
<p>One important caveat: the developers position this as a <strong>privacy tool</strong>, not a security tool. eBPF limitations prevent deep packet inspection, so it can’t do everything the macOS version does.</p>
<h2>What’s open source and what isn’t</h2>
<p>It’s partially open source:</p>
<ul>
<li>The eBPF kernel component is open source</li>
<li>The web UI is open source</li>
<li>The rules and blocklist backend is free but closed source</li>
</ul>
<h2>System requirements</h2>
<p>The tool requires Linux kernel 6.12+ with BTF support. In practice, that means Ubuntu 25.04 or newer. The developers mentioned that kernel 5.17+ support could be added via community contributions.</p>
<p>Packages are available as <code>.deb</code> files for x86-64, ARM64, and RISCV64.</p>


Collections

Objective Development has released a Linux version of Little Snitch, their popular macOS network monitor. The Linux port uses eBPF for kernel-level traffic interception and is written in Rust, with a web-based UI that also supports remote server monitoring. The tool is positioned as a privacy tool rather than a security tool due to eBPF limitations preventing deep packet inspection. It is partially open source — the eBPF kernel component and web UI are open source, while the rules and blocklist backend is closed source. Requires Linux kernel 6.12+ with BTF support, meaning Ubuntu 25.04 or newer in practice. Packages are available for x86-64, ARM64, and RISCV64.

Little Snitch is now available on Linux

<p>For lazy people <em>like me</em> here are the links:</p>
<p><a href="https://obdev.at/products/littlesnitch-linux/index.html" target="_blank" rel="noopener nofollow">https://obdev.at/products/littlesnitch-linux/index.html</a>
<a href="https://github.com/obdev/littlesnitch-linux" target="_blank" rel="noopener nofollow">https://github.com/obdev/littlesnitch-linux</a></p>


<p>&quot;License</p>
<p>Little Snitch for Linux has three components. The eBPF kernel program and the web UI are both released under the GNU General Public License version 2 and available on <a href="https://github.com/obdev/littlesnitch-linux" target="_blank" rel="noopener nofollow">GitHub</a>. The daemon (<code>littlesnitch --daemon</code>) is <a href="https://obdev.at/products/littlesnitch-linux/license.html" target="_blank" rel="noopener nofollow">proprietary, but free to use and redistribute.&quot; i find it a bit concerning that the daemon part of this is closed source , as in , we have proper open source network monitoring daemons that work just fine </a></p>


<p>Love it! I hope they fix the compatibility issue with kernel 6.19.x as that’s what universal blue atomic fedoras (like aurora, bazzite, etc) are generally on now.</p>
