Anyone who switches from macOS to the Linux world will sooner or later miss exactly one tool: Little Snitch. The granular network monitor was the standard tool for over two decades to keep apps from phoning home.
On Linux, the landscape looked bleak for a long time. There were open alternatives like OpenSnitch, which followed the same principle but never quite reached the polish of the original. Now the developers of Objective Development have released an official Linux version.
The developers' reasoning is compelling: They themselves have increasingly switched to Linux and simply missed the tool. A growing number of developers are seeking more privacy and architectural control — an observation I absolutely share.
The Tech: eBPF Instead of Deep Kernel Hacks
The core of the new architecture is eBPF (Extended Berkeley Packet Filter).
Instead of building risky kernel modules, the logic runs as an isolated program directly in the kernel and analyzes outgoing connections. This happens without performance penalties from context switches into user space. Thanks to CO-RE (Compile Once – Run Everywhere), it runs across different kernel versions without constant recompilation.
The prerequisite is kernel 6.12 with BTF support (BPF Type Format). The accompanying daemon, written in Rust, evaluates the eBPF signals and presents them in a web interface. You don't get a native desktop GUI — instead, you manage blocklists and traffic diagrams via localhost:3031.
The difference from traditional firewalls is fundamental.
While iptables or nftables stubbornly block by ports or IP addresses, Little Snitch works at the app level. The daemon knows which process is establishing the connection, and you decide: always allow, allow once, or block completely.
It's true that Linux lacks the deep packet inspection available under macOS, but for classic privacy scenarios, eBPF is more than sufficient. Firefox phones home telemetry right at startup? VS Code pings Microsoft servers uninvited? The log shows it all — mercilessly.
Installation
As long as your system is up to date, installation is straightforward.
Kernel check:
uname -r
You need at least 6.12. On current rolling releases like Arch Linux, this works out of the box. On Fedora, there is currently a bug with Btrfs filesystems in version 1.0.0, which prevents processes from being properly attributed. You should wait for version 1.0.1.
Packages are available as .deb, .rpm, and .pkg.tar.zst directly on the official download page.
For Arch / Manjaro:
sudo pacman -U littlesnitch-1.0.0-x86_64.pkg.tar.zst
After that, the daemon is enabled via systemd:
sudo systemctl enable --now littlesnitch-daemon
Running littlesnitch in the terminal opens the web UI directly in your browser. No complex config files — network traffic is scanned and visualized immediately.
Limitations and Trade-offs
Despite all the praise: there's a catch. The eBPF part and the UI are open source (GPL2) and available on GitHub, but the Rust daemon itself is proprietary. For absolute FOSS purists, this is a dealbreaker.
Additionally, the tool is primarily designed for privacy, not hardcore security. A malicious app could attempt to spoof the process name, since deep packet inspection is missing.
This is a technical trade-off you need to be aware of.