GyulyVGC/sniffnet

Sniffnet is a cross-platform network traffic sniffer that provides a graphical interface and command-line tools for monitoring live captures, importing PCAP files, and analyzing IPFIX flows. It parses various network protocols to visualize traffic statistics, identify hosts by country and ASN, and manage connection details through a customizable, multi-language GUI. The system supports configurable notifications for data thresholds and blacklisted IPs, with packaging for Linux, macOS, and Windows to ensure proper system integration and permissions.

36 changes.

The project underwent a significant architectural shift, migrating from a monolithic structure to a modular workspace with a dedicated packet parser library. This period focused on rebuilding the user interface using the iced framework, introducing a comprehensive theming engine, and adding complex features like configurable notifications, detailed traffic reporting, and multi-language support. Concurrently, the team refined the networking backend, expanded platform packaging for Linux, macOS, and Windows, and integrated robust configuration management.

6 changes.

The project significantly expanded its network analysis capabilities by introducing a dedicated packet parser and IPFIX collector to support ARP, IGMP, and VLAN protocols. Concurrently, infrastructure work focused on automating resource generation and establishing reproducible Debian source packaging for Ubuntu PPA distribution.

Sniffnet now includes the necessary Debian packaging files (control, rules, changelog, copyright, and asset notices) and a Python staging script to build reproducible source packages. This enables the project to publish updates to the Ubuntu PPA (ppa:gyulyvgc/sniffnet) via an automated workflow, handling vendored Rust dependencies, license compliance, and the installation of network capture capabilities.

resources/packaging/linux/deb-source, resources/packaging/linux/deb-source/debian · high confidence

The Linux packaging resources now include a .desktop file and a description text file to support proper application integration on Linux desktop environments. The .desktop file defines the application entry with the name 'Sniffnet', sets the correct executable path, assigns it to Network and Utility categories, and includes search keywords (traffic, inspect, monitor, internet, network) to improve discoverability in application menus. The description file provides a detailed list of features for documentation or installer purposes.

resources/packaging/linux · high confidence

New shell scripts have been added to automate resource generation: fonts.sh subsets the Sarasa Mono font to include only necessary glyphs, and services.sh generates the services.txt file by fetching and filtering port-to-service mappings from nmap.

resources/scripts · high confidence

A new .well-known/funding-manifest-urls file has been added to the repository, pointing to https://sniffnet.app/funding.json. This enables external services and platforms to discover the project's funding information via the standard .well-known protocol.

.well-known · high confidence

Users can now launch Sniffnet on macOS via a native application bundle. This change introduces an Info.plist defining the app metadata (including the bundle identifier io.github.gyulyvgc.sniffnet) and a wrapper script that executes the binary with administrator privileges through a system prompt, ensuring the application integrates correctly with the macOS environment.

resources/packaging/macos · high confidence

The application now supports 25 languages, including newly added options such as Czech, Hungarian, Sinhala, Uzbek, Vietnamese, Indonesian, Dutch, and Finnish, alongside existing ones like English, German, French, Spanish, Italian, Polish, Ukrainian, Simplified and Traditional Chinese, Romanian, Korean, Portuguese, Turkish, Russian, Greek, Swedish, and Japanese. Each language is associated with a specific country flag icon for visual identification in the settings, and the system tracks translation completeness, marking several languages as fully up-to-date.

src/translations/types · high confidence

This entry introduces the main entry point for the Sniffnet network traffic sniffer, initializing the iced-based GUI with specific window settings (including Linux Wayland support via application ID), custom font loading (Sarasa Mono and icons), and CLI argument handling. It sets up the core application structure, including panic handling differences between debug and release modes, and configures the initial window state and subscriptions for the sniffer interface.

src · high confidence

The \sniffnet-packet-parser\ library has been added to the codebase, providing a dedicated module for parsing network packet headers. This new component introduces support for ARP and IGMP protocols, which were not previously handled, and enables the extraction of VLAN IDs from PCAP-based captures. It defines structured types for link, network, and transport layer information, including specific message types for ICMPv4/v6, ARP, and IGMP, and is gated behind a 'full' feature flag to control the inclusion of these extended protocol parsers.

lib/sniffnet-packet-parser/src · high confidence

The application now defines explicit enums for the primary navigation states: \RunningPage\ (Overview, Inspect, Notifications) and \SettingsPage\ (Notifications, Appearance, General). These types provide a consistent way to cycle through tabs using \next\ and \previous\ methods, retrieve localized tab labels, and display corresponding icons. This change establishes the foundational data structures for the GUI's page switching logic, ensuring that navigation actions are strongly typed and easily extensible.

src/gui/pages/types · high confidence

The application now includes a dedicated module for country-related types, introducing a \Country\ enum that represents ISO 3166-1 alpha-2 country codes. This enum supports serialization and deserialization via Serde, enabling persistent storage and data interchange for country-specific data within the application.

src/countries/types · high confidence

The application now includes a new notification module that monitors traffic for data thresholds, favorite hosts/services, and IP blacklist hits. When these conditions are met, users receive in-app logged notifications, optional audio alerts (respected during PCAP imports), and remote notifications sent via HTTP to a configured URL. The system also identifies top contributing hosts and services for threshold breaches and supports custom sounds and volumes.

src/notifications · high confidence

The application now defines a \MyModal\ enum to manage the state of various user interface overlays. This change introduces support for specific modal dialogs including Reset, Quit, ClearAll, and UpdateStatus, as well as a ConnectionDetails modal that displays address and port information. This provides the structural foundation for the UI to handle these distinct interaction states.

src/gui/components/types · high confidence

A new command-line interface has been added to allow users to manage application settings and start captures without opening the GUI. Users can now restore default settings via the --restore-default flag, which resets the configuration file and prints a confirmation message. The --config-path flag displays the location of the configuration file. On Windows (non-debug builds), the --logs flag opens the log file in the system explorer, while its absence triggers a log file truncation to clear previous run data. Additionally, the --adapter flag enables users to specify a network interface to begin packet capture immediately upon launching the application.

src/cli · high confidence

The application now includes dedicated pages for viewing connection details, managing notifications, and configuring general settings. The connection details page displays comprehensive information about a selected connection, including source and destination addresses, MAC addresses, latency, and program details. The notifications page allows users to view and manage data threshold, favorite, and IP blacklist notifications, with options to expand/collapse entries and clear all notifications. The general settings page provides controls for language selection, scale factor, expanded view mode, MMDB file paths for country and ASN lookups, and IP blacklist configuration. These pages integrate with the existing tab navigation system and support the application's theming and localization features.

src/gui/pages · high confidence

The application now includes a dedicated IPFIX collector (src/networking/ipfix) that parses IPFIX datagrams to extract flow data. This new capability supports ARP flows, IGMP, and VLAN IDs, and correctly handles RFC 5103 biflows by accounting for reverse-direction traffic. It also improves data fidelity by supporting layer-2 octet counts, post-counters, and flow timestamps, while using a TTL-based cache to manage templates and baseline counters from exporters.

src/networking/ipfix · high confidence

The application now includes a new \src/countries\ module that provides SVG-based country flag icons and utility functions for displaying them. This change introduces a comprehensive set of embedded SVG assets for countries (e.g., \AD\, \AE\, \AF\...) and a \country\_utils.rs\ module that handles rendering these flags as \Svg\ widgets with tooltips, opacity adjustments for inactive hosts, and support for special cases like bogon addresses or loopback traffic. The \flags\_pictures.rs\ file defines constants for icon sizes and includes the raw SVG bytes for each country code, enabling the UI to display visual country indicators in network traffic overviews and host lists.

src/countries · high confidence

Users can now choose from several new color palettes in the application's theme settings. This update introduces dedicated modules for accessibility-focused themes (A11y), as well as popular developer color schemes including Dracula, Gruvbox, Nord, Solarized, and Yeti, each providing both light and dark variants.

_src/gui/styles/custom\themes · high confidence

The report module now includes a new \get\_report\_entries\ function that filters network traffic based on search constraints, favorite hosts/services/programs, and resolves hostnames via rDNS. It returns paginated results (30 entries per page) along with an aggregated data summary, enabling efficient display of search results in the UI.

src/report · high confidence

The application now includes a new \check\_updates\ module that periodically checks GitHub for newer releases using semver comparison, and an \error\_logger\ module that provides a unified way to log errors with file and line location, panicking in debug mode but logging silently in release mode. These utilities support the update notification feature and improve error handling consistency across the application.

src/utils · high confidence

The application introduces several new utility types in the \src/utils/types\ module to support upcoming UI and functional improvements. A \CaseInsensitiveString\ wrapper is added to enable case-insensitive sorting in dropdown lists. A \FileInfo\ enum and \ALLOWED\_PCAP\_EXTENSIONS\ constant define valid file extensions for imports (pcap, pcapng, cap, dmp) and style/database files, while a \WebPage\ enum centralizes URLs for external links like the GitHub repository, website, and roadmap. Additionally, an \Icon\ enum maps UI icons to specific font codepoints, and a \Timestamp\ struct provides precise time handling with overflow-safe conversion to microseconds.

src/utils/types · high confidence

The notification system has been refactored to support sending alerts to a configurable remote URL (webhook). The \Notifications\ configuration struct now includes a \RemoteNotifications\ section with an active flag and URL field, allowing users to direct notifications to an external endpoint. Additionally, the \LoggedNotifications\ type was introduced to track and store the last 30 logged events (such as data threshold exceedances, favorite transmissions, and blacklisted connections) for display in the UI, while the underlying data structures for these events now include detailed host, service, and country information in their JSON representations.

src/notifications/types · high confidence

The original standalone main.rs file, which performed basic packet capture and printed link/IP/transport headers to stdout, has been deleted. This change removes the initial, unstructured implementation in favor of the refactored modular architecture present in the rest of the source tree.

_packet\sniffer/src · high confidence

The GUI source code has been restructured into a modular layout under \src/gui\, splitting the application logic into dedicated submodules for components, pages, styles, types, and the core sniffer state. This change improves code organization and maintainability by separating concerns within the user interface layer.

src/gui · high confidence

A change to existing behaviour in resources/DB — 11 commits, 2 files.

resources/DB · medium confidence · unverified

The networking backend in src/networking has been refactored to use the sniffnet-packet-parser library instead of the previous etherparse-based implementation. This change updates the packet parsing pipeline (capture.rs, parse\_packets.rs, manage\_packets.rs) to handle link-layer headers, VLAN IDs, and protocol details via the new parser, ensuring compatibility with the updated library and fixing build errors associated with older etherparse versions.

src/networking · high confidence

The application now uses a unified \Conf\ structure in \src/gui/types\ to persist and manage all user settings, including window size and position, capture source, BPF filters, IPFIX collector details, PCAP export paths, favorites, and UI preferences. This change introduces fault-tolerant deserialization that automatically fills missing fields with defaults and replaces invalid values, ensuring backward compatibility with older configuration files. It also adds runtime sanitization to enforce valid ranges for settings like scale factor and notification volume, and prevents directory traversal in PCAP export file names by stripping slashes.

src/gui/types · high confidence

The application's localization system has been restructured into six dedicated translation modules (translations.rs through translations\_6.rs) to accommodate a growing list of supported languages. This change introduces full or partial translations for Sinhala (SI), Uzbek (UZ), Vietnamese (VI), Indonesian (ID), and Dutch (NL), alongside updates to existing languages like German, Russian, and Japanese. The new modules also add translations for recently introduced features, including IPFIX exporter/collector status messages, latency checks, custom report paths, and IP blacklist management, ensuring these new UI elements are accessible to a wider global audience.

src/translations · high confidence

The report module now defines explicit types to manage the Inspect page's data presentation and filtering. The \ReportCol\ enum standardizes column definitions (Source/Destination IP, Port, Protocol, Service, Data) with consistent width constraints, character limits for CJK languages, and dynamic title generation. Search logic is centralized in \SearchParameters\, which supports granular filtering by IP, port, protocol, service, country, domain, AS name, program, and exporter, including support for favorites and blacklist toggles. Filter inputs now recognize specific prefixes (\=\, \!=\, \!\) for exact, negative, and exclusion matching. Additionally, \SortType\ provides a unified enum for table sorting states (Ascending, Descending, Neutral) with associated UI icons and button styles.

src/report/types · high confidence

The GUI component library has been reorganized into distinct modules (button, ellipsized\_text, footer, header, modal, tab) to improve maintainability. The header and footer have been adjusted to support an expanded view mode with reduced heights, and the footer now includes a pulsing heart animation to indicate new messages. A new EllipsizedText widget handles long text truncation with ellipses, and tab components now feature a notification badge for unread items.

src/gui/components · high confidence

The charting subsystem has been refactored to use a new \ChartSeries\ data structure that employs cosine-like spline interpolation for smoother, more accurate traffic visualizations. This change introduces support for handling large time gaps in offline PCAP captures without freezing the GUI, by compressing idle periods into flat lines. Additionally, a new donut chart component has been added to display traffic breakdowns (incoming, outgoing, dropped) with proper color styling and legend support, replacing previous static SVG-based representations.

src/chart · high confidence

The application's styling system has been refactored to support first-class theming, introducing a new \StyleType\ enum that includes built-in themes (A11y, Dracula, Gruvbox, Nord, Solarized, Yeti) and user-defined custom palettes. Users can now load custom themes via TOML files, with the system handling serialization of colors as hex strings and managing palette extensions for UI elements like buttons and alerts. Additionally, a new \GradientType\ feature allows users to apply mild or wild color gradients to headers and buttons, configurable through the style settings.

src/gui/styles/types · high confidence

The application's interface has been visually refreshed with a more modern and minimal aesthetic. Buttons, containers, and rules now feature updated border radii and widths, while many elements support color gradients and specific states like 'highlighted' or 'alert'. Scrollbars are now styled to appear selectively on hover, and sliders have been updated with circular handles and improved rail visuals. These changes apply to the core widget styling layer, affecting the look and feel of buttons, text inputs, picklists, toggles, and charts throughout the GUI.

src/gui/styles · high confidence

The networking type definitions have been restructured to support new features and improved data handling. A new \CaptureContext\ enum now manages live, offline, and IPFIX capture sources, including logic for BPF filter application and PCAP savefile handling. Traffic statistics are now tracked via a new \DataInfo\ struct that supports packets, bytes, and bits representations, replacing the previous flat counters. Host and service tracking have been updated to use new \Host\ and \Service\ types, with \InfoAddressPortPair\ now storing MAC addresses as fixed-size arrays and including program and VLAN information. Additionally, a \Bogon\ module has been added to identify and tag private, loopback, and other special IP ranges, and \AddressPortPair\ now includes an optional \IpfixExporter\ field to support IPFIX-collected flows.

src/networking/types · high confidence

The MMDB lookup types have been refactored to support both standard MaxMind and IPinfo database formats. New generic entry structs (MmdbAsnEntry and MmdbCountryEntry) handle field name variations (e.g., 'asn' vs 'autonomous\_system\_number', 'country\_code' vs 'country.iso\_code') via serde aliases and untagged enums, allowing the application to correctly parse ASN and country data from IPinfo databases alongside MaxMind ones.

src/mmdb/types · high confidence

The MMDB lookup module now supports IPinfo's MaxMind-format databases in addition to the default GeoLite2 databases. New generic entry types (MmdbAsnEntry, MmdbCountryEntry) and a unified MmdbReader allow the get\_asn() and get\_country() functions to correctly parse and return data from IPinfo ASN and location databases when a custom reader is provided, while maintaining backward compatibility with the existing GeoLite2 defaults.

src/mmdb · high confidence

The Windows packaging setup (setup.wxs) has been updated to include a post-installation dialog that prompts users to open the Npcap website, ensuring the required network capture driver is installed for the application to function correctly.

resources/packaging/macos/graphics, resources/packaging/windows · high confidence

A new post-installation script (postinst) has been added to the Linux packaging resources. This script ensures that the SniffNet binary is granted the necessary network capabilities (cap\_net\_raw and cap\_net\_admin) upon installation, allowing the application to perform raw network operations without requiring root privileges for every execution.

resources/packaging/linux/scripts · high confidence

Added test data files to support unit testing of the IP blacklist feature, including valid and invalid IP formats, CIDR ranges, and mixed IPv4/IPv6 entries with comments.

resources/test · high confidence

The project has updated its core dependencies, including the GUI framework iced to 0.14.0, the argument parser clap to 4.6.6, and the date/time library jiff to 0.2.35. The build system has been restructured into a workspace containing the main application and a separate \sniffnet-packet-parser\ library, replacing the previous \packet\_sniffer\ crate. Additionally, the lock file has been regenerated to reflect these changes.

(dependencies) · high confidence

Cleanup of Rust build artifacts in target/debug; Initial repository structure and contributor tracking; Removed Rust build artifacts from repository.

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 49 → 76 (+27.7)
• Rubric changed (rubric-2026.08.15 → rubric-2026.09.15) — scores are not directly comparable.

• Code Health 100 → 94 (-5.6)
• Architecture 95 (new)
• Maturity 54 → 71 (+17.6)
• Readiness 35 → 85 (+49.6)
• Security 56 → 72 (+16.3)

• Dimension evaluation failed
• High IaC: DS-0029 (Dockerfile)
• High IaC: DS-0029 (Dockerfile)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• …and 20 more

• Boundary-crossing change coupling: asn.rs ↔ manage_packets.rs (src/mmdb/asn.rs)
• Boundary-crossing change coupling: overview_page.rs ↔ get_report_entries.rs (src/gui/pages/overview_page.rs)
• Boundary-crossing change coupling: sniffer.rs ↔ data_info_host.rs (src/gui/sniffer.rs)
• Boundary-crossing change coupling: sniffer.rs ↔ translations_6.rs (src/gui/sniffer.rs)
• ButtonType::hovered (cyclomatic 20) (src/gui/styles/button.rs)
• Change coupling clique: config_window.rs, settings.rs, config_device.rs (src/gui/types/config_window.rs)
• Change coupling: overview_page.rs ↔ thumbnail_page.rs (src/gui/pages/overview_page.rs)
• Change coupling: parse_packets.rs ↔ data_info_host.rs (src/networking/parse_packets.rs)
• Change-coupling hub: custom_palette.rs → dracula.rs, gruvbox.rs, solarized.rs (src/gui/styles/types/custom_palette.rs)
• ClassTooLong: Sniffer (src/gui/sniffer.rs)
• Duplicated block (10 lines × 2) (src/gui/components/modal.rs)
• Duplicated block (10 lines × 3) (src/gui/styles/slider.rs)
• Duplicated block (11 lines × 2) (src/gui/components/tab.rs)
• Duplicated block (12 lines × 2) (lib/sniffnet-packet-parser/src/packet.rs)
• Duplicated block (12 lines × 2) (src/gui/styles/button.rs)
• Duplicated block (12–13 lines × 3) (src/gui/pages/settings_notifications_page.rs)
• Duplicated block (13 lines × 2) (src/gui/styles/toggler.rs)
• Duplicated block (13 lines × 2) (src/networking/manage_packets.rs)
• Duplicated block (17 lines × 2) (src/gui/components/header.rs)
• Duplicated block (17 lines × 2) (src/gui/styles/slider.rs)
• …and 98 more

• 132 commits — 126 feature/other, 6 fixes

• src/networking — 36 commits
• src/gui — 29 commits
• (repo) — 25 commits
• (root) — 18 commits
• lib/sniffnet-packet-parser — 13 commits
• .github/workflows — 4 commits
• src/chart — 3 commits
• resources/packaging — 1 commit
• resources/repository — 1 commit
• src/countries — 1 commit
• src/report — 1 commit

• fix: Merge pull request #1275 from cuyua9/fix/favorites-unresolved-host-filter-cuyua9
• fix: Merge pull request #1290 from GyulyVGC/fixes
• fix: fix clippy
• fix: fix freeze when importing a PCAP with a large time gap between consecutive packets
• fix: fix rustrict build and add TODO about PCAP's dispatch()
• fix: fix(inspect): allow favorites for unresolved hosts
• change: Add Ubuntu PPA source packaging and publication workflow (#1311)
• change: Bump docker/setup-buildx-action in the github-actions group
• change: Bump docker/setup-qemu-action in the github-actions group
• change: Bump signpath/github-action-submit-signing-request
• change: Bump the cargo group across 1 directory with 6 updates
• change: Bump the github-actions group across 1 directory with 2 updates
• change: Conf sanitization: don't allow NotApplicable service and program stored as favorite
• change: Conf sanitization: remove slashes from PCAP export file name
• change: IPFIX collector: don't parse zero as a valid port number
• change: IPFIX collector: improve exit condition on data record decoding
• change: IPFIX collector: on resume, drop datagrams queued while paused
• change: IPFIX collector: support ARP flows
• change: Merge branch 'main' into all-contributors/add-jorgemonizribeiro-blip
• change: Merge branch 'main' into dependabot/cargo/main/cargo-96ca1852da
• …and 112 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

GyulyVGC/sniffnet was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.