A secure, multithreaded network packet sniffer written in Rust, designed for safe operation on untrusted networks.
sniffglue is a network packet sniffer written in Rust that securely captures and parses network traffic. It uses multithreaded processing to efficiently analyze packets across all CPU cores while implementing strong security measures like seccomp sandboxing to prevent system compromise. The tool is designed to be crash-resistant and provide useful, human-readable output by default for common protocols.
Network administrators, security researchers, and developers who need to analyze network traffic securely, especially in untrusted environments or containerized setups.
Developers choose sniffglue for its unique combination of security-first design, multithreaded performance, and reliability. Unlike many packet sniffers, it's explicitly built to run safely on hostile networks without crashing, making it ideal for security-critical applications.
Secure multithreaded packet sniffer
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses a thread pool to parse network packets concurrently across all CPU cores, ensuring efficient utilization on multi-core systems, as highlighted in the project goals.
Implements seccomp syscall restrictions and privilege dropping with a configurable hardening file (/etc/sniffglue.conf), making it safe for untrusted networks, as detailed in the Security section.
Engineered to avoid crashes during packet processing, even with malformed input, supported by fuzzing tests (cargo-fuzz) to ensure reliability.
Can be built as a small Docker image (~11.1MB) for debugging container network setups, providing an easy way to deploy in isolated environments, as mentioned in the Docker section.
Does not support 802.11 for wireless traffic analysis, which is a notable gap compared to more comprehensive sniffers, as listed in the protocols section.
Building from source requires external dependencies like libpcap and libseccomp, adding setup overhead for users on systems without pre-packaged versions.
Operates solely in the terminal, which may be less user-friendly for those accustomed to GUI tools like Wireshark for visual packet analysis.