picosnitch — per-process traffic tracking

Linux / Modern CLI Tools / picosnitch.html

💬 "picosnitch command"

picosnitch is a tool that tracks network traffic per executable. Using Linux's modern eBPF technology, it accurately maps which executable sends and receives packets, and how much bandwidth each one uses.

Unlike bandwhich or iftop, which show connections and process names, picosnitch hashes the executable itself and records it. It even differentiates apps running inside containers, and logs parent and grandparent processes to catch bypasses through scripts or wrappers.

• Concept: Combines low-overhead eBPF traffic collection with fanotify-based executable-modification watching.
• Main Feature: Keeps per-executable bandwidth and connection logs, and verifies executables by hash.
• Advantage: Tracks the true source of traffic even in script, container, and multi-process environments.
• Usage: Useful for watching which program sends data outbound in the background.

Basic Usage

picosnitch runs a background daemon that captures packets with eBPF and records which executable sent/received traffic. The flow is: start daemon → check status → query (or GUI).

1. Start the daemon

After installing, start the daemon; it records traffic automatically from then on.

picosnitch start      # start background daemon
picosnitch status     # check daemon status

2. Inspect per-process traffic

Query which executable sent/received how much. Add gui to open the visualization window.

picosnitch query "SELECT name, outgoing_bytes, incoming_bytes FROM process ORDER BY outgoing_bytes DESC LIMIT 10"
picosnitch gui        # view in the web GUI

3. Stop

Run picosnitch stop to halt the daemon. The recorded DB remains, so you can re-query later.

Installation and Download

picosnitch installs as a Python package and runs as a resident daemon.

eBPF requires kernel 4.15 or newer. After installing, run picosnitch config to set what to monitor and where to store logs.

Commonly Used Commands

Three Essential Command Combinations

• sudo picosnitch start — start the traffic-collection daemon
• picosnitch query "select executable_name, sum(bytes_recv) from conns group by executable_name order by 2 desc limit 5" — top 5 executables by received bytes
• picosnitch gui — visualize the collected traffic as graphs

💬 "Show me a real-world example of finding a leaking process with picosnitch on a server"

Situations you frequently meet on a production server, in order.

Step 1 · Start the daemon and check status

Start the daemon after installing and check its status.

sudo picosnitch start
picosnitch status

Step 2 · Check top receiving processes

Find the executables receiving the most data.

picosnitch query "select executable_name, count(*) as conns, sum(bytes_recv) as recv from conns group by executable_name order by recv desc limit 10"

Step 3 · Trace a suspicious process

Inspect the detailed connections of a specific process.

picosnitch query "select executable_path, remote_address, remote_port, bytes_sent, bytes_recv from conns where executable_name = 'suspicious_app' order by bytes_sent desc limit 20"

How It Is Used in Practice

1. Detect background data exfiltration

Situation — Find out which program is sending data outbound.

picosnitch query "select executable_name, remote_address, sum(bytes_sent) as sent from conns group by executable_name, remote_address order by sent desc limit 10"

Result — Sent bytes are shown per executable and destination IP.

Key point — If an unknown process sends large amounts to an external IP, check for exfiltration or malware.

2. Separate container apps

Situation — Check the traffic of apps running inside containers separately.

picosnitch query "select executable_name, count(*) from conns where executable_path like '/var/lib/docker%' group by executable_name"

Result — Connection counts per executable inside containers.

Key point — Executable hashing differentiates even different versions with the same name.

Caveats

• eBPF requires kernel 4.15 or newer.
• Traffic collection requires root.
• Only the executable itself is hashed, so shared libraries and scripts are not covered by the hash.
• It is log- and query-centric rather than a live terminal dashboard, so use picosnitch gui for immediate visual inspection.