Littlesnitch Linux

This is an open source eBPF-based network monitor and blocker for Linux, written in Rust with the Aya framework. It intercepts network connections at the kernel level using TC classifiers and LSM hooks, then shares data with user space via eBPF maps. You load blocklists from text files (IPs and domain suffixes), and the demo runner populates the maps and reads connection events back out. The architecture is clean: an ebpf crate for kernel programs, a common crate for shared types, and a demo runner that ties it all together. Requires kernel 5.15+ and root privileges. This is the open core of Objective Development's Little Snitch for Linux, so you get the monitoring primitives but not the full UI or rule engine.

skills.sh installs: 414
GitHub stars: 25
last updated: Jun 3, 2026

View on GitHub

Install

$ npx -y skills add aradotso/trending-skills --skill littlesnitch-linux --agent claude-code

Installs into .claude/skills of the current project.

Files

Little Snitch for Linux — eBPF Network Monitor

Skill by ara.so — Daily 2026 Skills collection.

Little Snitch for Linux is an open-source eBPF-based network monitoring and blocking toolkit written in Rust. It attaches eBPF programs to the Linux kernel to intercept network connections, then shares data between kernel and user space via eBPF maps. The open-source portion includes eBPF programs, shared types, and a demo runner; the full product from Objective Development includes additional proprietary UI and rule-engine components.