Open-source tool Snitch shows who your computer talks to; volunteers built its Windows port

From a simple question to a tool

In a dev.to post published October 18, a developer writing under the name aixis_studio describes building Snitch, an open-source desktop tool designed to answer one question in real time: which applications on your machine are talking to which servers, in which countries. Released under the AGPL and hosted on GitHub, the project reportedly gathered around 400 stars in its first three weeks.

The author frames the motivation as a gap between existing tools. Wireshark can already capture packets, the post notes, but it is built for deep inspection, whereas the author wanted a broad, at-a-glance overview. On macOS, Little Snitch handles connection alerting, but it costs $59 and, in the author's view, no real equivalent exists on Windows. Snitch is meant to be that live visual layer: app, server, country, right now.

Under the hood

According to the post, the design constraints were no heavy dependencies and no telemetry, ever. The capture layer binds directly to libpcap on macOS and Linux and to Npcap on Windows using ctypes, rather than pulling in Scapy. Packet parsing is handled by hand-written decoders for IPv4, IPv6, TCP, UDP, DNS and TLS server name indication, and the entire pipeline is described as roughly 2,000 lines of code.

The backend is FastAPI with WebSockets, feeding a SQLite ring buffer that keeps 24 hours of history and then deletes itself — a deliberate choice, since the author argues a privacy tool should not hoard data either. The frontend is React with a D3 force graph and a TopoJSON world map. Geolocation runs off a local MaxMind/DB-IP file, and the post stresses that IP addresses never leave the machine. The API listens on loopback only and is token-authenticated; the sole outbound traffic is the GeoIP database download, which requires explicit user consent.

Distribution is handled through prebuilt releases for macOS and Windows, a demo mode that runs without admin privileges via the SNITCH_DEMO environment variable, and a Docker image for Linux.

How the Windows port happened

The part the author says was unplanned: after shipping the macOS version first and marking Windows as a help-wanted area, contributions arrived within days. Bug reports came with stack traces and root-cause analysis rather than bare complaints. A contributor the author had never spoken to submitted three pull requests covering Npcap capture, network interface selection and a startup crash. A different volunteer opened a pull request to package the tool for winget, Windows's package manager.

Per the post, version 1.0.5 shipped the week before publication with the Windows port fully working. The author's takeaway is that putting a real problem in public turned out to be the project's most effective growth channel, because people who share the problem showed up and started building.

Traffic data shaped the documentation

The post includes a self-referential detail: referral traffic to the project revealed that a Chinese tech newsletter, ruanyifeng.com, had featured it, and roughly 20% of visitors were Chinese readers looking at an English README. The project responded by adding a full Chinese README, alongside its existing English and French interface. As the author puts it, the data decided and they listened.

Why it matters

Two things lift this beyond a hobby-project anecdote. First, Snitch targets a widely felt need — visibility into background network activity — with a local-first architecture: no account, no telemetry, a 24-hour data horizon, and on-device geolocation. Because the code is AGPL-licensed, the claim that your traffic data stays local is auditable rather than a promise.

Second, it is a compact case study in how open-source development scales in practice. The original author wrote the macOS version; the Windows port, including the genuinely tricky Npcap integration, arrived through unsolicited pull requests from users who wanted the tool on their platform. Fast, useful responses to bug reports converted reporters into contributors, which is how a three-week-old project ended up cross-platform. The lesson the author draws for tool builders: solve a felt problem, make the trust architecture visible, and let the community that shares the problem do part of the building.