Agent skill · security · aradotso
littlesnitch-linux
Open source eBPF-based network monitoring and blocking components for Little Snitch on Linux
Why this skill is useful
Adds executable eBPF programs for network monitoring and blocking that are not commonly available in public documentation.
What it needs
Requires cargo, clang, rustup installed locally. About 5k tokens when loaded. Last updated 2026-07-09. 70 stars on the source repository.
What this skill does
Little Snitch for Linux — eBPF Network Monitor Skill by ara.so — Daily 2026 Skills collection. Little Snitch for Linux is an open-source eBPF-based network monitoring and blocking toolkit written in Rust. It attaches eBPF programs to the Linux kernel to intercept network connections, then shares data between kernel and user space via eBPF maps. The open-source portion includes eBPF programs, shared types, and a demo runner; the full product from Objective Development includes additional proprietary UI and rule-engine components. --- Architecture Overview Crates: ebpf/ — eBPF kernel-space programs (compiled to BPF bytecode) common/ — Shared types between kernel and user space demo-runner/ — User-space loader and event consumer webroot/ — JavaScript web UI --- Prerequisites Rust Toolchains System Dependencies Kernel Requirements Linux kernel 5.15+ (for BTF and CO-RE support) eBPF enabled in kernel config (CONFIGBPF=y, CONFIGBPFSYSCALL=y) CAPBPF or root privileges to load eBPF programs --- Build & Run Note: Cargo build scripts automatically compile the eBPF programs and embed them in the binary — no manual eBPF compilation step needed. --- Blocklist Configuration The demo runner loads two blocklist files at startup: blockedhosts.txt One IP address or hostname per line: blockeddomains.txt One domain suffix per line (blocks domain and all subdomains): Place these files in the working directory before running: --- Common Crate — Shared Types The common crate defines types shared between kernel eBPF code and user-space. When extending the project, add new shared types here. --- eBPF Crate — Kernel Programs eBPF programs live in ebpf/src/ and are compiled to BPF bytecode using the nightly toolchain. --- Demo Runner — User Space Loader The demo runner uses Aya to load eBPF programs and interact with maps. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/littlesnitch-linux