The Problem
Many developers and power users need a lightweight, crossâplatform way to see which processes and destinations are consuming bandwidth. Existing tools are either too lowâlevel (tcpdump, Wireshark) or too heavyweight (fullâfeatured firewalls). A comfortable UI that aggregates traffic, groups by application, and stays out of the way is rare.
What This Does
Sniffnet is a GUI traffic monitor written in Rust. The entry point is src/main.rs, which boots the application framework and loads the main window. Core responsibilities are split across a few modules:
src/gui/â contains the user interface: components such asellipsized_text.rs,footer.rs, and pages likeinitial_page.rs(all suffer from deep nesting, max indentation depthâŻ9).src/networking/â packet capture and flow logic lives inmanage_packets.rs(â1996 lines, one of the oversized files).src/chart/types/â defines chart series (chart_series.rs), the traffic chart (traffic_chart.rs), and a preview chart (preview_chart.rs). These three files share 49 repeated 6âline blocks across 19 files, violating DRY.src/translations/translations.rsâ holds all localization strings (â1996 lines, another oversized file).resources/DB/â two GeoIP databases (GeoLite2-ASN.mmdb,GeoLite2-Country.mmdb) used for destination resolution.src/cli/mod.rsâ CLI argument parsing that feeds into the same duplicated logic found in the chart modules.
The project uses Cargo as its package manager, a Dockerfile for containerised builds, and GitHub Actions for CI/CD. The import graph spans 149 code files (146 Rust + 3 Shell) with no circular dependencies.
How It Is Wired
Execution flows as follows:
src/main.rscreates theAppstruct and starts the GTK-based UI loop.- The UI delegates packet capture to
src/networking::manage_packets, which opens apcaphandle and feeds parsed frames into a sharedTrafficStatechannel. src/chart/typesobservesTrafficStateand renders realâtime graphs; the duplicated 6âline blocks compute series metrics (bytes per second, perâprocess breakdown).- GeoIP lookâups use the MMDB files from
resources/DB/via a small helper that maps IP â ASN/country; the result is attached to each flow entry. - Translations are loaded from
src/translations/translations.rsat startâup and passed to every UI component.
Hubs & blast radius â manage_packets.rs and translations.rs are the largest singleâresponsibility files (â2000âŻlines each). A change in packet parsing or language strings ripples through the UI and chart modules because they depend on the data structures those files expose. The duplicated chart logic spreads the same fix across 19 files, raising the cost of a single bugâfix.
How To Use It
Setup
# Clone the repository (exact URL as given)
git clone https://github.com/moses-y/sniffnet.git
cd sniffnet
# Build from source (Cargo)
cargo build --release # produces a binary in target/release/sniffnet
# Or build the Docker image
docker build -t sniffnet .
Configuration The application ships with the GeoIP databases already placed in resources/DB/. No additional environment variables are required; the DB paths are hardâcoded relative to the executableâs working directory.
Running it
# From the repo root after a release build
./target/release/sniffnet
# Or run inside the container
docker run --rm -v $(pwd)/resources:/resources sniffnet
The UI appears with an overview of total traffic, a perâapplication breakdown, and a notifications panel.
RealâWorld Use
A DevOps engineer suspects a rogue service is leaking data. Launching Sniffnet shows a âTop Talkersâ list; the engineer spots an unexpected process, clicks it, and sees detailed flow data including resolved country (via the GeoIP DB). The engineer can then terminate the process or adjust firewall rules, all without leaving the Sniffnet window.
Code Health & Issues
- High cognitive load â deep nesting in
src/gui/components/ellipsized_text.rs,src/gui/components/footer.rs,src/gui/pages/initial_page.rs(max indentation depthâŻ9). - High duplicated code â 49 repeated 6âline blocks across
src/chart/types/chart_series.rs,src/chart/types/traffic_chart.rs,src/chart/types/preview_chart.rs,src/cli/mod.rsetc. - High oversized files â
src/gui/sniffer.rs,src/networking/manage_packets.rs,src/translations/translations.rseach exceed 1900 lines, making changes highârisk. - Medium â no further issues detected; tests, CI, license, lockfile, and committed secrets are all present and clean.
The Bottom Line
Sniffnet delivers a functional, crossâplatform traffic monitor with solid Rust underpinnings and useful GeoIP enrichment. The codebase is functional but suffers from nesting depth, duplicated chart logic, and a few very large files that raise maintenance risk. It is wellâsuited for developers, DevOps, or anyone needing a quick, visual bandwidth overview without the overhead of packetâcapture tools. If you can tolerate the current structural debt, it works outâofâtheâbox; otherwise, expect refactoring effort to flatten nesting and extract shared chart helpers.