$ show elesiuta/picosnitch
picosnitch is a Linux daemon for per-executable network bandwidth monitoring using eBPF (CO-RE) and fanotify. It tracks which executables make network connections, records bytes sent/received, timestamps, and metadata (SHA256 hashes, optional VirusTotal and GeoIP lookups). The system provides real-time and historical views via multiple interfaces: a curses TUI (both live top and historical browser), a web UI, and a UNIX socket live feed. The daemon uses a multiprocess architecture with privilege-separated subprocesses for monitoring, event processing, database writes, notifications, and external API queries. It supports local SQLite storage and optional remote SQL (MariaDB/MySQL/PostgreSQL) for tamper-evident logging. The repository also includes a comprehensive comparative benchmark suite (bench/) that tests picosnitch against nine other network monitors across 24 scenarios, with a reusable ToolAdapter framework for running controlled experiments.
The LLM identified 3 files worth highlighting for reuse:
Implements a generic UNIX socket publisher/subscriber pattern for real-time event streaming. The LiveFeedPublisher broadcasts JSON events to connected subscribers, and LiveFeedSubscriber provides an iterator interface. This module is self-contained, with no imports from other internal modules beyond basic types, making it directly extractable as a small library for inter-process communication in any Linux application.
Provides shared curses UI primitives used by both the live top and historical TUI views. Includes a status bar, help popup, modal overlay, and safe text rendering with control character sanitization. The module demonstrates careful handling of terminal edge cases (cursor positioning, color pairs, Unicode width) and can be reused in any curses-based Python application with minimal adaptation.
Defines an abstract ToolAdapter base class with a lifecycle of install/start/pre_trial/collect/stop methods, enabling uniform benchmarking of any CLI or service-based network monitoring tool. Includes concrete adapters for 9 tools and reusable helper methods like _poll_cumulative() for monotonic bandwidth polling with plateau detection. This pattern is directly reusable for evaluating other command-line tools in controlled experiments.