A free, open-source Little Snitch alternative for Windows (yes, it exists)

Your computer talks to hundreds of servers every day. Most of it is fine — updates, sync, telemetry you signed up for. Some of it isn't. The question "who is my machine actually talking to?" is the reason Little Snitch has been a macOS staple for 15 years.

The problem: Little Snitch doesn't exist on Windows or Linux. And most Windows "alternatives" are either paid, account-required, or firewall-first when all you wanted was visibility.

I'm the author of Snitch, an open-source (AGPL) real-time network visualizer that just shipped its Windows port — so, full disclosure upfront. Here's the honest state of the options.

First: visualizer vs blocker

Worth being precise, because people conflate them:

• Visibility = "show me who my machine talks to" (a map, per-app attribution, history)
• Blocking = "let me decide what's allowed" (firewall rules, prompts)

Little Snitch does both. Some alternatives do one or the other. Know which job you need.

The honest comparison

What Snitch actually does

One sentence: a live map of every connection your computer makes — which app, which server, which country.

• Force-graph + world map of connections in real time, geolocated offline (MaxMind/DB-IP — no IP leaves your machine)
• Process attribution: which app opened the connection, not just the IP
• Anomaly detection: port scans, beaconing patterns, potential exfiltration volume
• Privacy score + tracker detection from editable suffix lists
• Per-app traffic view, timeline (15/30/60 min), 24h SQLite history
• Passive LAN scanner (reads the ARP table — shows every device on your network)

The part that matters to privacy people: everything is local. No account, no telemetry, no outbound calls at all unless you explicitly opt into downloading the GeoIP database. The API is token-authenticated and bound to loopback by default.

What Snitch does NOT do

Honesty section, because HN/Reddit will ask anyway:

• It doesn't block. It's a visualizer — it shows you, it doesn't decide for you. If you want blocking on Windows, pair it with Portmaster or use your firewall rules based on what Snitch reveals.
• It needs admin/root for packet capture (unavoidable — same as Wireshark).
• Windows has no tray app yet — it's a backend exe + the UI in your browser. Works, but less polished than the macOS app.
• Deep packet dissection — for that, Wireshark still wins. Snitch is the 10,000-foot view.

Installing on Windows

1. Install Npcap (the Windows packet-capture driver — required, same dependency as Wireshark)
2. Grab snitch-backend-windows.zip from the latest release
3. Run snitch-backend.exe as Administrator
4. Open the URL it prints — the UI runs in your browser

Linux: docker run --network host ghcr.io/aixisstudio/snitch — or the release tarball. macOS: the packaged app or brew.

A note on how the Windows port happened

I maintain the project solo. The Windows port wasn't me — users filed bug reports with root-cause analysis included, then a stranger sent three PRs that fixed capture + the right network interface + the startup crash. Open source working as advertised. v1.0.5 shipped last week.

If you try it and it catches something interesting, there's a "What did you catch?" discussion on the repo. And if it's useful to you, a ⭐ on GitHub genuinely helps the project get found.

Repo: https://github.com/aixisstudio/Snitch — AGPL, EN/FR UI, 中文 README.