Name: Snitch
Availability: InStock
Author: aixisstudio

$ sudo docker run --network host --cap-add NET_ADMIN --cap-add NET_RAW -v snitch-data:/app/data ghcr.io/aixisstudio/snitch

Updated4 days ago

LanguagePython

Setup difficultyModerate

ThemeDark mode

Stars: 638
Port: 8000 (HTTP API and Web UI)
Requires: libpcap / Npcap

Docker

ghcr.io/aixisstudio/snitch

Live force graph showing LAN perimeter, geolocated hosts, and alerts

What is Snitch?

Snitch is a privacy-first network monitoring tool that lets you see every outbound connection from your computer in real time. It displays a live force-directed graph with your machine at the center, a geolocated world map of remote hosts, and a sliding timeline of traffic history. The software detects anomalies like port scans, beaconing, DNS tunneling, and data exfiltration patterns using pure-Python ML models. It can block connections through the OS-native firewall (Windows Filtering Platform, nftables/iptables, pf) rather than filtering in user space. Snitch runs as a desktop app (Electron/React) on macOS, Windows, and Linux, plus a headless daemon for servers and a Docker container for Linux. All data stays local in SQLite with configurable retention; geolocation uses an offline DB-IP Lite database. Optional integrations include syslog/SIEM export (CEF, RFC 3164), webhooks to chat platforms, and threat intelligence lookups with your own API keys. The project is licensed under AGPL-3.0 and has no telemetry or mandatory outbound calls.

Should you self-host Snitch?

Snitch scores 54/100 on selfhost.directory (how scoring works) and ranks #20 of 48 in Network Monitoring. It has 638 GitHub stars.

It shipped 10 stable releases in the past year. The latest, v1.6.4, came out on 23 October 2026.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is AGPL-3.0-licensed and written mostly in Python.

Its closest alternative on selfhost.directory is mitmproxy (86/100, 46 448 stars). It scores higher overall, so compare the two before you pick. See Snitch vs mitmproxy side by side.

Features

Actionable alerts
Advanced Threat Detection
Anomaly Detection
Ask-on-connect (Linux)Linux only, requires root
Entropy watch
Firewall orchestration
Geolocated world map
ICMP tunnel detection
IOC peer sync
Memory forensicsLinux only
ML anomaly scoring
Passive TLS inspection
Real-time Network Monitoring
Sliding timeline history
Syslog/SIEM export

How to configure Snitch

ask_enabledfalseEnable ask-on-connect NFQUEUE mode (Linux only)
Enable ask-on-connect NFQUEUE mode (Linux only)
values: true, false
gossip_enabledfalseAutomatically push IOC packs to peers every 5 minutes
Automatically push IOC packs to peers every 5 minutes
values: true, false
gossip_peersList of explicit Snitch backend URLs for IOC peer sync
List of explicit Snitch backend URLs for IOC peer sync
values: List of host:port URLs
kill_switch_enabledEnable lockdown mode at startup
Enable lockdown mode at startup
values: true, false
portsPort filter list for capture
Port filter list for capture
values: List of port numbers
retention_hours24Data retention window in hours
Data retention window in hours
values: Integer hours
slm_enabledfalseEnable local LLM enrichment for alert explanations
Enable local LLM enrichment for alert explanations
values: true, false
slm_modeLLM mode: embedded (local .gguf) or ollama (loopback endpoint)
LLM mode: embedded (local .gguf) or ollama (loopback endpoint)
values: embedded, ollama
SNITCH_BIND127.0.0.1IP address the API binds to (default: 127.0.0.1)
IP address the API binds to (default: 127.0.0.1)
values: IP address or 0.0.0.0 for LAN access
SNITCH_DEMORun in demo mode with synthetic traffic (no root/libpcap needed)
Run in demo mode with synthetic traffic (no root/libpcap needed)
values: 1 to enable
SNITCH_DISABLE_PTRDisable reverse DNS PTR lookups
Disable reverse DNS PTR lookups
values: 1 to disable
SNITCH_NO_UPDATEDisable automatic update checks
Disable automatic update checks
values: 1 to disable
SNITCH_PORT8000Port the API listens on
Port the API listens on
values: Any valid port number
SNITCH_TOKENFixed API token instead of auto-generated
Fixed API token instead of auto-generated
values: Any string
syslog_addrSyslog destination for alert forwarding (UDP host:port or tcp://host:port)
Syslog destination for alert forwarding (UDP host:port or tcp://host:port)
values: host:port or tcp://host:port
syslog_formatrfc3164Syslog format (rfc3164 or cef)
Syslog format (rfc3164 or cef)
values: rfc3164, cef
ti_feedsSchedule automatic threat feed refreshes with hot firewall reload
Schedule automatic threat feed refreshes with hot firewall reload
values: Configuration object
webhook_enabledfalseEnable webhook alert forwarding
Enable webhook alert forwarding
values: true, false
webhook_urlWebhook endpoint for alert forwarding (Discord, Slack, Telegram, or generic)
Webhook endpoint for alert forwarding (Discord, Slack, Telegram, or generic)
values: URL