Re:OpenSnitch – A Linux clone of the Little Snitch applicati...
by cyphar on Tuesday May 02, 2017 @11:45PM
(#14252878)
> The other thing worthy of note is that it appears every single packet will need to be processed through this application
No, only the initial connection requests will go into the netfilter queue (as well as DNS requests so that it knows what a particular IP actually refers to). Packets sent as part of a connection aren't vetted, and it uses the marking feature of netfilter so all of the actual filtering is done by the kernel.
No, only the initial connection requests will go into the netfilter queue (as well as DNS requests so that it knows what a particular IP actually refers to). Packets sent as part of a connection aren't vetted, and it uses the marking feature of netfilter so all of the actual filtering is done by the kernel.