# Install sniffer with Homebrew

Modern alternative network traffic sniffer. Version 0.6.3 via Homebrew; verified 2026-07-26.

## Install

```sh
sudo av install brew:sniffer
```

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install sniffer
```

  Evidence: local Homebrew formula metadata

## Package facts

- **Package key:** brew:sniffer
- **Package manager:** Homebrew
- **Version:** 0.6.3
- **Source summary:** Modern alternative network traffic sniffer
- **Homepage:** <https://github.com/chenjiandongx/sniffer>
- **Repository:** <https://github.com/chenjiandongx/sniffer>
- **Last updated:** 2026-07-26T04:03:42+02:00
- **Generated:** 2026-08-03T19:37:03+00:00

## Executables

- sniffer (alias)

## Install behavior

- Bottle: not available

## Freshness

- Page generated: 2026-08-03
- Package-manager version: 0.6.3
## Project history and usage

sniffer is a terminal network traffic analyzer written as a modern alternative to tools such as bandwhich and nethogs. It uses libpcap through gopacket and presents process and connection traffic in a responsive TUI.

### Project history

The public GitHub repository was created in 2021. The official README describes a troubleshooting tool that can be started on demand without loading kernel modules and can capture traffic across Linux, macOS, and Windows-specific process matching approaches.

### Adoption history

The project has a narrower packaging footprint than the older networking tools it references. The supplied package facts list Homebrew packaging, while the README documents Go installation and Homebrew installation on macOS.

### How it is used

Users run sniffer with flags for BPF filters, device prefixes, refresh interval, view mode, DNS resolution, and traffic units. The README documents bytes, packets, and plot modes plus terminal hotkeys.

### Why package nerds care

sniffer is notable as a small Go CLI that still depends on platform packet-capture facilities: libpcap on Unix-like systems and npcap on Windows. That makes it a packaging example where a statically built Go binary still has native capture prerequisites.

### Timeline

- 2021: Public GitHub repository created.
- 2021: README links an introductory article dated 2021-11-17.
- 2025: GitHub metadata shows repository updates after initial release.

### Related projects

- The official README names gopacket, libpcap, bandwhich, nethogs, ss, lsof, gopsutil, npcap, and iperf as related tools or dependencies.

### Sources

- <https://api.github.com/repos/chenjiandongx/sniffer>
- <https://github.com/chenjiandongx/sniffer#readme>
- source_facts.package-manager


## Security Notes

broad file, network, media, or database tool signal. escape, surveillance, or offensive capability signal.

- **Geiger risk:** red / medium
- broad file, network, media, or database tool signal
- escape, surveillance, or offensive capability signal


## Combined YAML source

View the package source record on GitHub. [combined/sniffer.yml](https://github.com/mxcl/pkgdb/blob/main/combined/sniffer.yml)


## Sources

- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- cross-ecosystem install command graph