Network Forensics: Getting Started with Sniffnet Monitoring Tool

Welcome back!

Network packet monitoring has long been an important skill for tech experts, especially those in cybersecurity. Like any skill, it demands a bit of studying and hands-on practice. While Wireshark has been a go-to tool for many, it can be somewhat cumbersome for beginners who simply want to see whom they’re exchanging data with. That’s where Sniffnet comes in — a tool built to make network monitoring more approachable without sacrificing depth.

In this article, we’ll dive into what Sniffnet is, how to install it, and provide a practical comparison of its features alongside those of Wireshark.

What is Sniffnet?

Sniffnet is an open-source, cross-platform network monitoring tool developed in Rust. It captures and analyzes traffic flowing through a device’s network interfaces in real-time. Unlike traditional packet analyzers that typically display raw packet data, Sniffnet prioritizes visual clarity. It features a user-friendly dashboard that showcases live charts, protocol breakdowns, and geographic context instead of just a continuous stream of hex dumps.

Step #1: Installation

In this demonstration, I’ll be testing Sniffnet on Kali Linux, though it’s also cross-platform compatible with Windows and macOS. To get started with installation, we need to visit the official download webpage and choose the package. I’ll choose the DEB file. To install, just run the following command:

sudo dpkg -i /home/kali/Downloads/Sniffnet_LinuxDEB_amd64.deb

That’s it — we’re ready to start monitoring the traffic.

After starting the app, we need to choose the network adapter and click Start. If your system makes any network connections, you’ll see it as shown below.

The interface is straightforward. The screen is divided into blocks. At the top right, we can see the traffic rate. Beyond the live chart, Sniffnet also renders a donut chart showing cumulative statistics for the entire capture session. It tracks total incoming, outgoing, and dropped data.

Any packet sniffer can show you an IP address and a port number. Sniffnet goes further. The application can identify more than 6,000 upper-layer services, protocols, trojans, and worms flowing across your interface. Instead of staring at port 443 traffic and shrugging, Sniffnet can tell you the actual service behind that connection — in this case, HTTPS.

Besides that, every remote host your machine communicates with gets mapped to a physical location, so you can see at a glance whether your traffic is staying local or hopping across continents to servers you’ve never heard of. Beyond location, Sniffnet also pulls the Autonomous System Number (ASN) and domain name associated with each host. Knowing the ASN tells you which organization or provider owns that piece of the internet. As you can see from the screenshot above, most requests were made to Cloudflare US servers — nothing fancy, but it makes overall analysis much simpler for beginners.

The main page provides a solid overview of network traffic. But when you find something worth digging into — say, an interesting host — you can click on it and see the full communication history.

Practical Comparison: Sniffnet vs. Wireshark

Step 1: Getting an Overview of the Capture

When you load a pcap file into Sniffnet, it immediately renders the total traffic, direction split, and a donut chart of incoming, outgoing, and dropped data. Wireshark can surface the same information, but it requires navigating menus and reading tables rather than seeing it visually on load. To get an equivalent summary in Wireshark, go to Statistics > Capture File Properties or Statistics > Protocol Hierarchy.

Both tools can answer “what’s in this capture,” but one shows it, the other tells it.

As you can see in the screenshot above, in Sniffnet we simply need to change the data representation to packets — and that’s it. In Wireshark, the equivalent requires navigating to Statistics > Endpoints > IPv4. Note that Wireshark has no built-in geolocation or ASN lookup, so you’d need a GeoIP database configured separately, or pivot to an external tool like whois.

Step 3: Digging Into the Actual Conversation

Wireshark clearly stands out here. By right-clicking a suspicious stream and selecting Follow TCP Stream, you can uncover the actual payload — which may include plaintext credentials, encoded commands, or unusual headers. In the XWorm malware infection I examined, this Remote Access Trojan (RAT) encrypts commands sent from the Command and Control (C2) server using AES in ECB mode, making the payload unreadable. While we can see the ciphertext, Sniffnet has no capability to analyze it at this level. Sniffnet presents connection metadata, service labels, and host details — it isn’t designed for raw payload inspection. This is exactly why Wireshark remains essential even after Sniffnet handles the initial triage.

Step 4: Extracting Evidence

Since version 1.3, Sniffnet allows exporting captured network traffic as a PCAP file. You can configure this on the initial page of the app. By default, the option is disabled, but enabling it is as simple as checking the dedicated checkbox.

Wireshark offers a variety of flexible export options. You can save the entire packet capture in formats like PCAP, export only the packets you’ve selected, or even extract packet dissections as plain text. Additionally, you can choose to export specific protocol objects, such as HTTP files, or save the raw packet bytes.

Step 5: Filtering Down to What Matters

Sniffnet has built-in filtering options, filtering by IP address, port, protocol, or application layer service directly through the UI. This is menu-driven and requires no syntax to learn.

Wireshark’s display filter syntax is where it really pulls ahead. Filters like ip.addr == 5.252.177.69 combined with http.request.method == "POST" let you drill down to exactly what you need. You can chain logical operators, target specific fields deep within a protocol, match payload content by string, or isolate packets by flag. Sniffnet simply has no equivalent for that level of precision.

Summary

When comparing Sniffnet and Wireshark, it’s clear that each tool has its place. Sniffnet is great for monitoring network traffic and keeping tabs on your internet activity — it’s effective for gathering statistics and identifying who your machine is exchanging data with. But it falls short when it comes to more in-depth network investigations. Wireshark, on the other hand, covers a much broader range of capabilities for monitoring, filtering, and exporting traffic.

If you’re simply looking to check your traffic at a glance, Sniffnet will get the job done. But if you’re aiming to go deeper and sharpen your network analysis skills, Wireshark is the way to go.

Stay curious!