LittleSnitch for Linux

Re:LittleSnitch for Linux by serious_angel on Wednesday April 08, 2026 @09:01PM (#47698130)

  > The macOS version can make stronger guarantees because it can have more complexity. On Linux, the foundation is eBPF, which is powerful but bounded: it has strict limits on storage size and program complexity. Under heavy traffic, cache tables can overflow, which makes it impossible to reliably tie every network packet to a process or a DNS name.  
  > And reconstructing which hostname was originally looked up for a given IP address requires heuristics rather than certainty. The macOS version uses deep packet inspection to do this more reliably.  
  > That's not an option here.
  > 
  > Source: https://web.archive.org/web/20260409002901/https://obdev.at/products/littlesnitch-linux/index.html

The above feels like an utter AI slop nonsense, sorry. I believe eBPF, the Linux Kernel feature, is absolutely capable for accuracy and perfect processing of network traffic.

Have you ever checked Calico or Cilium, or at least, Oryx?

[ Parent | on HN ]

Re:LittleSnitch for Linux by jiveturkey on Wednesday April 08, 2026 @09:24PM (#47698280)

I guess you haven't actually implemented anything in eBPF.

[ Parent | on HN ]

Re:LittleSnitch for Linux by heatpump5n on Wednesday April 08, 2026 @11:42PM (#47699041)

Can you elaborate? I thought eBPF was created to be used in high performance scenarios, so I am confused why this shouldn't be posssible.

[ Parent | on HN ]

Re:LittleSnitch for Linux by jiveturkey on Thursday April 09, 2026 @04:40PM (#47709664)

eBPF runs in an extremely constrained environment, in order to protect the kernel. indeed, it's quite high performance. but not high flexibility.

[ Parent | on HN ]

Re:LittleSnitch for Linux by serious_angel on Thursday April 09, 2026 @07:51AM (#47702447)

I have, but in the scopes of Kprobes non-network but memory. Here, I am sure you haven't at this point. I also provided projects you may check prior stating another nonsense. Instead, you could also provide some more evidence you disagree with.

[ Parent | on HN ]

Re:LittleSnitch for Linux by littlesnitch on Thursday April 09, 2026 @07:02AM (#47702042)

eBPF programs are able to accuratly process network traffic in high performance, but the amount of CPU instructions you can use is limited. Otherwise it would not be high performance. This limits the complexity of in-kernel processing.

[ Parent | on HN ]

Re:LittleSnitch for Linux by serious_angel on Thursday April 09, 2026 @07:52AM (#47702462)

Thank you for the response. Yet, how the heck the CPU instructions you inject in (that are being processed within the same network processing) limit the capabilities of the flow, if you literally put your calls within the same networking context? Please provide any actual document that proves your point.

[ Parent | on HN ]