Little Snitch for Linux: eBPF Firewall with Process Monitoring and Traffic Blocking
Little Snitch is now available for Linux, leveraging eBPF to intercept all outbound network connections. The daemon collects traffic data tied directly to specific processes—no kernel modifications required. A web interface at localhost:3031 displays real-time activity: active connections, historical logs, and traffic volume. Filter by process name, activity level, or bandwidth to quickly spot suspicious behavior. Block traffic with a single click, and rules are saved for future sessions.
Traffic graphs visualize load spikes and allow you to isolate time intervals for deep analysis. This is essential for mid-to-senior developers managing servers or desktops where app telemetry flows out unmonitored.
Custom Rules and Blocklists Configuration
Custom Rules
Rules are defined via TOML configs in /var/lib/littlesnitch/config/. Override files in /var/lib/littlesnitch/overrides/ take precedence, making testing safe without risking the base setup. Example: Allow all Firefox traffic but block outbound connections from a specific CLI tool.
Blocklists
Pre-built lists integrated: Hagezi, Peter Lowe, Steven Black, oisd.nl. Formats include domain-per-line, /etc/hosts, and CIDR. Note: .lsrules from macOS aren’t compatible—conversion is needed for migration.
- Process-based blocking: Tied to PID/executable, not IP addresses.
- Port/protocol control: Granular TCP/UDP filtering.
- History & statistics: Track bytes transferred and request frequency per domain.
- PWA support: Install the interface as a standalone app in Chromium or Firefox.
Trade-off: eBPF limits cache size under heavy load, reducing packet attribution accuracy—but coverage for privacy remains near 100%.
Architecture and Trade-offs
eBPF programs in the kernel send metadata to the daemon, which aggregates stats and applies filters. Unlike macOS, there’s no deep packet inspection—Linux version focuses on connection metadata (process ID, destination port/domain). Under high load (thousands of connections/sec), eBPF maps can fill up, causing some packets to lose attribution.
eBPF advantages: Zero-copy data transfer, minimal overhead, scales well across multi-core systems.
Limitations: Strict program size limits (up to 1MB after JIT), no payload inspection. Authors emphasize: this is a privacy tool, not a defense-in-depth solution against targeted attacks. For production use, pair it with nftables.
Headless server deployment: Access via SSH tunnel (ssh -L 3031:localhost:3031) or nginx reverse proxy. No GUI dependencies—daemon runs silently in the background.
Licensing and Customization
- eBPF module: GPLv2, source code on GitHub.
- Web interface: GPLv2, open source.
- Daemon: Proprietary, free for personal and commercial use.
TOML configuration enables scripting: automate rule management using Ansible or Chef. Valuable for senior devs who need telemetry control in CI/CD pipelines or Kubernetes pods where containers generate unregulated traffic.
Key Takeaways
- eBPF enables process-aware monitoring without kernel modules, with low overhead.
- Web UI + PWA for convenience; headless mode for servers.
- Blocklists and rules cover 90% of privacy-focused use cases—but don’t replace DPI.
- Fully free, unlike the €59 macOS version.
- Trade-off: reduced accuracy under extreme load due to eBPF constraints.
— Editorial Team
No comments yet.