LittleSnitch for Linux

Re:LittleSnitch for Linux by littlesnitch on Thursday April 09, 2026 @08:14AM (#47702678)

On macOS, it requires access to /dev/bpf. That's why we added filter rules for bpf there.

On Linux, we intercept at a level where packets already have an Ethernet header. I hope that Paqet injects before* this layer, but only a test can give the proof.

[ Parent | on HN ]

Re:LittleSnitch for Linux by thewanderer1983 on Thursday April 09, 2026 @05:34PM (#47710472)

Thanks for the response. Sorry I should of been less vague. Paqet works on raw sockets with KCP. Though it's intended for good. What's to assume bad actors aren't also using this method to get around solutions like littlesnitch?

A recent example, but not the only is a Iran a botnet, using this to get around detection.

https://cybersecuritynews.com/iran-linked-botnet-exposed-aft...

[ Parent | on HN ]

Re:LittleSnitch for Linux by littlesnitch on Friday April 10, 2026 @07:06AM (#47716276)

Little Snitch for Linux is not made to defend against malware. You need to code with paranoia in mind from the very beginning if you want that.

[ Parent | on HN ]