sniffglue(1)

💅 sniffglue(1) — the secure multithreaded packet sniffer, bestie edition 🎀

okay so real talk, this is sniffglue(1) from the General Commands Manual, and it's about to be your new fave. sit down, grab a strawberry drink 🍓, and let me tell you everything.

---

✨ NAME ✨

sniffglue — a secure multithreaded packet sniffer. that's the whole vibe. no cap.

---

🦋 SYNOPSIS 🦋

sniffglue [-vrpVh] [-n <threads>] device

that's it. that's the whole incantation. the way that one line does so much?? iconic.

---

🌸 DESCRIPTION 🌸

okay so sniffglue is a network sniffer written in rust (yes, that rust, the one everybody won't shut up about, and honestly? deserved). network packets get parsed concurrently using a thread pool so it can utilize all cpu cores — like a group chat where literally everyone is typing at once and somehow it still works. 💅

the project goals are, and I quote the energy of them:

• you can run sniffglue securely on untrusted networks — sketchy café wifi, who? never heard of her 🙈
• it must not crash when processing packets. main character stability. it does not do drama. 🔥
• the output should be as useful as possible by default — no configuration archaeology required, it just serves. periodt.

---

💜 OPTIONS 💜

bestie, here's the whole menu, nothing skipped:

• -v, --verbose — turns up the filter sensitivity so you see more packets (some of which are, lowkey, less useful 👀). the default only shows few packets, and you can specify this flag multiple times. maximum: 4 — yes, there is a limit, this is not an infinite vibe buffet.
• -h, --help — prints help information. the classic. 🫶
• -p, --promisc — sets the device to promiscuous mode. she's seeing everything. 💅
• -r, --read — opens device as a pcap file. so instead of sniffing live you're reading a dump. cozy.
• -n, --threads threads — specify the number of threads. you're the thread pool manager now, congrats. 👑
• -V, --version — prints version information. buuut if -r was specified, it opens as a pcap file instead. plot twist, iykyk. 😭

---

🧚 EXAMPLES 🧚

these are copy-paste ready, do not touch the spelling, it matters:

sniff with default filters (dhcp, dns, tls, http) from enp0s25:

sniffglue enp0s25

increase the filter sensitivity (arp):

sniffglue -v enp0s25

increase the filter sensitivity (cjdns, ssdp, dropbox, packets with valid utf8):

sniffglue -vv enp0s25

almost everything:

sniffglue -vvv enp0s25

everything:

sniffglue -vvvv enp0s25

read a dump from sniff.pcap, with increased filter sensitivity and decode packets with 1 thread:

sniffglue -vvrn1 sniff.pcap

see that -vvrn1?? all crammed together, a little chaotic, absolutely slaying. 🌈

---

⭐ PROTOCOLS ⭐

the full roster she parses, in the original order:

• ethernet
• ipv4
• ipv6
• arp
• tcp
• udp
• http
• tls
• dns
• dhcp
• cjdns eth beacons
• ssdp
• dropbox beacons

a whole ensemble cast, honestly. 🎀

---

🔒 SECURITY 🔒

to report a security issue please contact kpcyrd on ircs://irc.hackint.org. that's the channel, that's the person, go there. 💖

🛡️ SECCOMP 🛡️

so the whole point: to ensure a compromised process doesn't compromise the system, sniffglue uses seccomp to restrict the syscalls that can be used after the process started. it's giving seatbelt but for syscalls.

this happens in two stages:

1. first at the very beginning — directly after env_logger initialized ✨
2. once after the sniffer has been setup, but before packets are read from the network 🦋

two stages, not one. don't skip stage one, it's literally the first thing that happens.

🌸 HARDENING 🌸

during that second stage, there's also some general hardening applied — and this happens before all unneeded syscalls are finally disabled.

those hardening steps are system specific, so a configuration file is read from /etc/sniffglue.conf.

that config file specifies:

• an empty directory for chroot 📁
• an unprivileged account in user that is used to drop root privileges 👑

so she starts powerful and then gives up the crown. humble. 🫶

🧪 FUZZING 🧪

the packet processing of sniffglue can be fuzzed using cargo-fuzz.

everything you should need is provided in the fuzz/ directory that is distributed along with its source code.

⚠️ please note: this program links to libpcap, which is not included in the current fuzzing configuration. so like, heads up, fr fr.

---

👀 SEE ALSO 👀

go read these too, they're the supporting cast:

• pcap(3PCAP)
• seccomp(2)

---

💖 AUTHORS 💖

this program was originally written and is currently maintained by kpcyrd. bug reports and patches are welcome on github:

https://github.com/kpcyrd/sniffglue

go say hi, open a PR, be a little legend. 🌟

---

and that's the whole page, bestie — documented on 2026-04-20, and the manual you just read is sniffglue(1) itself, so yeah, you've officially been briefed. mwah. 💋🦋💅