PAGES
← all tools
◆ Network Analysis & Monitoring

sniffglue

v0.16.0 open-source

sniffglue is a network sniffer written in Rust that parses packets concurrently using a thread pool to utilize all CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. cores.

source ↗ rss ↗ What is a cyber toolchain?

Summary

sniffglue is an open-source network sniffer, free to use, that parses traffic concurrently across all CPU cores and decodes protocols like DHCP, DNS, TLS, HTTP, ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery., cjdns, and SSDP with increasing verbosity levels. It runs as a command-line tool, packaged for most major Linux distributions as well as Mac OSX, and is built with the explicit goal of surviving untrusted networks without crashing, making it suited to penetration testers and analysts who need to inspect traffic on hostile or unfamiliar networks rather than their own trusted infrastructure. It sits in the network-analysis category alongside tools like tcpdump and Wireshark, but its focus on safe parsing and readable default output rather than raw packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. sets its scope apart. First committed in 2017, it has drawn 13 contributors and saw 10 commits in the past year, suggesting slow but ongoing maintenance.

sniffglue is a network sniffer written in Rust that parses packets concurrently using a thread pool to utilize all CPU cores.

How sniffglue helps

What's actually talking on this network right now, without reconstructing it from raw packets?

decodes DHCP, DNS, TLS, HTTP and other application protocols on the fly and prints readable summaries instead of hex dumps

Which devices on this network are broadcasting themselves and could be worth a closer look?

at higher verbosity decodes ARP, cjdns beacons, SSDP and Dropbox beacons, surfacing devices announcing themselves that default-level filtering would hide

Are any credentials or plaintext requests crossing this network unencrypted?

separates out HTTP and DNS traffic from the stream so plaintext exchanges stand out from encrypted ones instead of being buried in a mixed capture

What is this unfamiliar machine or client actually requesting when it joins the network?

shows DHCP exchanges and DNS lookups as they happen, revealing what a host asks for as soon as it connects

How much of the traffic on this segment can I see if I want everything, not just the common protocols?

the top verbosity level decodes nearly every recognized protocol at once, including packets that only carry valid UTF-8, giving a fuller picture than the quiet default

all 7 features, with the evidence for each →

Languages

Not documented

Features

7 capabilities across 3 capability groups

Built from sniffglue's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • sniffglue covers 3 of the 34 network analysis capabilities we track.

What sniffglue offers you

  • Command-line interface1
  • Offline mode1
Packet capture (live and offline) 2 features Network analysis since 2017
Concurrent Packet Sniffing shipped Captures network traffic using a thread pool across all CPU cores to process packets concurrently. 1 release · 2 other sources · first seen Oct 2017

Shared capability: Packet capture (live and offline)

release

docs

  • Concurrent network packet sniffer written in Rust that parses traffic using a thread pool across all CPU cores.

example

  • Read and analyze a saved packet capture file for later investigation. sniffglue -r sniff.pcap v0.2.0 · Oct 2017 · source
File Capture Analysis shipped Reads and analyzes previously saved packet capture files for offline investigation. 1 release · 1 other source · first seen Oct 2017

Shared capability: Packet capture (live and offline)

Also counts toward: Command-line interface, Offline mode

release

example

  • Read and analyze a saved packet capture file for later investigation. sniffglue -r sniff.pcap v0.2.0 · Oct 2017 · source
Capture filtering (BPF) 1 feature Network analysis since 2018
Packet Filtering Control shipped Allows users to configure capture filters, including capturing all packets, default filters, specific protocols like ARP or cjdns, and adjusting sensitivity. 2 releases · 5 other sources · first seen Jun 2018

Shared capability: Capture filtering (BPF)

release

  • Adds -v (verbose) flag with multiple levels to control packet filtering granularity v0.7.0 · Jun 2018 · source · release history
  • The -x flag is removed; use -v instead to control verbosity v0.7.0 · Jun 2018 · source · release history

example

  • Capture everything sniffglue -vvvv enp0s25
  • Capture almost everything sniffglue -vvv enp0s25
  • Increase sensitivity to include ARP sniffglue -v enp0s25
  • Sniff with default filters sniffglue enp0s25
  • Include cjdns, ssdp, dropbox packets sniffglue -vv enp0s25
New protocol support (added dissectors) 1 feature Network analysis since 2018
Network Protocol Support shipped Parses traffic from specific network protocols such as Point-to-Point Protocol (PPP) on Linux cooked capture links. 5 releases · 1 other source · first seen Jun 2018

Shared capability: New protocol support (added dissectors)

release

example

  • Capture and decode cjdns ethernet beacons using sniffglue's new built-in decoder. sniffglue --decoder cjdns-eth-beacon -i eth0 v0.8.0 · Aug 2018 · source
Other / not yet classified 3 features Features we have not matched to a capability yet. A suggested match is marked.
Containerization and Sandboxing shipped Supports running in sandboxed environments via Docker containers, chroot, setuid drops, and seccomp filtering to limit system call exposure. 6 releases · 2 other sources · first seen Oct 2017

release

  • Adds --insecure-disable-seccomp flag to disable seccomp when it causes issues v0.12.0 · Mar 2021 · source · release history
  • Adds musl docker container with adjusted seccomp filters to support musl libc v0.4.0 · Nov 2017 · source · release history
  • Adds chroot to an empty folder before the second seccomp stage activates v0.3.0 · Oct 2017 · source · release history
  • Adds setuid drop to unprivileged user after device open and chroot v0.3.0 · Oct 2017 · source · release history
  • Adds --seccomp-like sandboxing via syscalls disabled in two stages on x86_64 v0.3.0 · Oct 2017 · source · release history
  • Adds support for building a Docker image for containerized sniffing v0.3.0 · Oct 2017 · source · release history

example

  • Disable seccomp filtering in environments where it interferes with packet capture. sniffglue --insecure-disable-seccomp -i eth0 v0.12.0 · Mar 2021 · source
  • Run sniffglue in a sandboxed container using the new Docker build. docker run --rm -it --cap-add=NET_RAW kpcyrd/sniffglue v0.3.0 · Oct 2017 · source
Fuzzing Support shipped Provides a command to fuzz packet processing for testing robustness. 3 releases · 2 other sources · first seen Oct 2017

release

example

  • Stream captured packets as structured JSON for downstream processing or logging. sniffglue -i eth0 -j v0.5.0 · Mar 2018 · source
  • Fuzz packet processing cargo fuzz run read_packet
Platform Compatibility shipped Supports specific CPU architectures including LoongArch64. 2 releases · first seen Jun 2018

release

  • Add support for LoongArch64 architecture v0.16.0 · Jan 2024 · source · release history
  • Enables Raspberry Pi 1 (armv6) and Raspberry Pi 2 (armv7) support via seccomp porting v0.7.0 · Jun 2018 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for sniffglue, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail sniffglue puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

10 entries

  1. January 20241
  3. October 20211
  5. September 20211
  7. March 20211
  9. August 20181
  11. June 20181
  13. March 20181
  15. November 20171
  17. October 20172
    Show

    10 entries

    1. v0.16.0 Jan 7, 2024 · release notes

      sniffglue v0.16.0 adds LoongArch64 support and improves TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. RST packet handling

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.16.0 https://github.com/kpcyrd/sniffglue.git
# already have the repo? check out this version:
$ git checkout v0.16.0
      • Add support for LoongArch64 architecture

      1 detail in Everything

    2. v0.14.0 Oct 27, 2021 · release notes

      sniffglue v0.14.0 adds Linux cooked capture support for PPP networks

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.14.0 https://github.com/kpcyrd/sniffglue.git
# already have the repo? check out this version:
$ git checkout v0.14.0
    3. v0.13.0 Sep 8, 2021 · release notes

      sniffglue v0.13.0 adds ICMP packet parsing support

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.13.0 https://github.com/kpcyrd/sniffglue.git
# already have the repo? check out this version:
$ git checkout v0.13.0
    4. v0.12.0 Mar 23, 2021 · release notes

      sniffglue v0.12.0 adds --insecure-disable-seccomp flag to bypass seccomp restrictions

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.12.0 https://github.com/kpcyrd/sniffglue.git
# already have the repo? check out this version:
$ git checkout v0.12.0
      └──▷ USE IT
      Disable seccomp filtering in environments where it interferes with packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic..
      shell 
      sniffglue --insecure-disable-seccomp -i eth0
      • Adds --insecure-disable-seccomp flag to disable seccomp when it causes issues

      1 detail in Everything

    5. v0.8.0 Aug 8, 2018 · release notes

      sniffglue v0.8.0 adds support for decoding cjdns ethernet beacons.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.8.0 https://github.com/kpcyrd/sniffglue.git
# already have the repo? check out this version:
$ git checkout v0.8.0
      └──▷ USE IT
      Capture and decode cjdns ethernet beacons using sniffglue's new built-in decoder.
      shell 
      sniffglue --decoder cjdns-eth-beacon -i eth0
      • cjdns eth beacon decoder

      1 detail in Everything

    6. v0.7.0 Jun 1, 2018 · release notes

      sniffglue v0.7.0 adds SSDP and Dropbox beacon decoders, Raspberry Pi 1/2 seccomp support

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.7.0 https://github.com/kpcyrd/sniffglue.git
# already have the repo? check out this version:
$ git checkout v0.7.0
      • Adds -v (verbose) flag with multiple levels to control packet filtering granularity
      • Adds ssdp decoder for capturing SSDP traffic
      • Adds dropbox beacons decoder for detecting Dropbox beacon packets
      • Enables Raspberry Pi 1 (armv6) and Raspberry Pi 2 (armv7) support via seccomp porting

      4 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The -x flag is removed; use -v instead to control verbosity
    7. v0.5.0 Mar 7, 2018 · release notes

      Adds JSON output for sniffglue

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.5.0 https://github.com/kpcyrd/sniffglue.git
# already have the repo? check out this version:
$ git checkout v0.5.0
      └──▷ USE IT
      Stream captured packets as structured JSON for downstream processing or logging.
      shell 
      sniffglue -i eth0 -j
    8. v0.4.0 Nov 18, 2017 · release notes

      sniffglue v0.4.0 adds seccomp support for musl libc and a docker config for privilege dropping

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.4.0 https://github.com/kpcyrd/sniffglue.git
# already have the repo? check out this version:
$ git checkout v0.4.0
    9. v0.3.0 Oct 18, 2017 · release notes

      sniffglue v0.3.0 adds seccomp/chroot/setuid sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls., Docker support, ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. decoder, and a man page

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.3.0 https://github.com/kpcyrd/sniffglue.git
# already have the repo? check out this version:
$ git checkout v0.3.0
      └──▷ USE IT
      Run sniffglue in a sandboxed container using the new Docker build.
      shell 
      docker run --rm -it --cap-add=NET_RAW kpcyrd/sniffglue
      Access the new man page for help with commands and configuration.
      shell 
      man sniffglue
      • Adds --seccomp-like sandboxing via syscalls disabled in two stages on x86_64
      • Adds chroot to an empty folder before the second seccomp stage activates
      • Adds setuid drop to unprivileged user after device open and chroot
      • Adds support for building a Docker image for containerized sniffing
      • Adds a man page for help

      5 details in Everything

    10. v0.2.0 Oct 2, 2017 · release notes

      sniffglue v0.2.0 adds pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. reading (-r), benchmarking, and fuzzing support.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.2.0 https://github.com/kpcyrd/sniffglue.git
# already have the repo? check out this version:
$ git checkout v0.2.0
      └──▷ TRY IT
      Read and analyze a saved packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file for later investigation.
      $ sniffglue -r sniff.pcap
      • -r <file> flag to read previously saved pcap files
      • Benchmarking mode for performance measurement
      • Fuzzing support for vulnerability testing

      3 details in Everything

    Project health

    Issue, contributor and maintainer activity in kpcyrd/sniffglue, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 2 ±0 vs prior 12 months
    2. Maintainers 1 +1 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 14 of 38 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 14
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 1,266
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback