The Problem

Many developers and power users need a lightweight, cross‑platform way to see which processes and destinations are consuming bandwidth. Existing tools are either too low‑level (tcpdump, Wireshark) or too heavyweight (full‑featured firewalls). A comfortable UI that aggregates traffic, groups by application, and stays out of the way is rare.

What This Does

Sniffnet is a GUI traffic monitor written in Rust. The entry point is src/main.rs, which boots the application framework and loads the main window. Core responsibilities are split across a few modules:

  • src/gui/ – contains the user interface: components such as ellipsized_text.rs, footer.rs, and pages like initial_page.rs (all suffer from deep nesting, max indentation depth 9).
  • src/networking/ – packet capture and flow logic lives in manage_packets.rs (≈1996 lines, one of the oversized files).
  • src/chart/types/ – defines chart series (chart_series.rs), the traffic chart (traffic_chart.rs), and a preview chart (preview_chart.rs). These three files share 49 repeated 6‑line blocks across 19 files, violating DRY.
  • src/translations/translations.rs – holds all localization strings (≈1996 lines, another oversized file).
  • resources/DB/ – two GeoIP databases (GeoLite2-ASN.mmdb, GeoLite2-Country.mmdb) used for destination resolution.
  • src/cli/mod.rs – CLI argument parsing that feeds into the same duplicated logic found in the chart modules.

The project uses Cargo as its package manager, a Dockerfile for containerised builds, and GitHub Actions for CI/CD. The import graph spans 149 code files (146 Rust + 3 Shell) with no circular dependencies.

How It Is Wired

Execution flows as follows:

  1. src/main.rs creates the App struct and starts the GTK-based UI loop.
  2. The UI delegates packet capture to src/networking::manage_packets, which opens a pcap handle and feeds parsed frames into a shared TrafficState channel.
  3. src/chart/types observes TrafficState and renders real‑time graphs; the duplicated 6‑line blocks compute series metrics (bytes per second, per‑process breakdown).
  4. GeoIP look‑ups use the MMDB files from resources/DB/ via a small helper that maps IP → ASN/country; the result is attached to each flow entry.
  5. Translations are loaded from src/translations/translations.rs at start‑up and passed to every UI component.

Hubs & blast radius – manage_packets.rs and translations.rs are the largest single‑responsibility files (≈2000 lines each). A change in packet parsing or language strings ripples through the UI and chart modules because they depend on the data structures those files expose. The duplicated chart logic spreads the same fix across 19 files, raising the cost of a single bug‑fix.

How To Use It

Setup

# Clone the repository (exact URL as given)
git clone https://github.com/moses-y/sniffnet.git
cd sniffnet

# Build from source (Cargo)
cargo build --release   # produces a binary in target/release/sniffnet

# Or build the Docker image
docker build -t sniffnet .

Configuration The application ships with the GeoIP databases already placed in resources/DB/. No additional environment variables are required; the DB paths are hard‑coded relative to the executable’s working directory.

Running it

# From the repo root after a release build
./target/release/sniffnet
# Or run inside the container
docker run --rm -v $(pwd)/resources:/resources sniffnet

The UI appears with an overview of total traffic, a per‑application breakdown, and a notifications panel.

Real‑World Use

A DevOps engineer suspects a rogue service is leaking data. Launching Sniffnet shows a “Top Talkers” list; the engineer spots an unexpected process, clicks it, and sees detailed flow data including resolved country (via the GeoIP DB). The engineer can then terminate the process or adjust firewall rules, all without leaving the Sniffnet window.

Code Health & Issues

  • High cognitive load – deep nesting in src/gui/components/ellipsized_text.rs, src/gui/components/footer.rs, src/gui/pages/initial_page.rs (max indentation depth 9).
  • High duplicated code – 49 repeated 6‑line blocks across src/chart/types/chart_series.rs, src/chart/types/traffic_chart.rs, src/chart/types/preview_chart.rs, src/cli/mod.rs etc.
  • High oversized files – src/gui/sniffer.rs, src/networking/manage_packets.rs, src/translations/translations.rs each exceed 1900 lines, making changes high‑risk.
  • Medium – no further issues detected; tests, CI, license, lockfile, and committed secrets are all present and clean.

The Bottom Line

Sniffnet delivers a functional, cross‑platform traffic monitor with solid Rust underpinnings and useful GeoIP enrichment. The codebase is functional but suffers from nesting depth, duplicated chart logic, and a few very large files that raise maintenance risk. It is well‑suited for developers, DevOps, or anyone needing a quick, visual bandwidth overview without the overhead of packet‑capture tools. If you can tolerate the current structural debt, it works out‑of‑the‑box; otherwise, expect refactoring effort to flatten nesting and extract shared chart helpers.