# Install sniffer with Homebrew Modern alternative network traffic sniffer. Version 0.6.3 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:sniffer ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install sniffer ``` Evidence: local Homebrew formula metadata ## Package facts - **Package key:** brew:sniffer - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.6.3 - **Source summary:** Modern alternative network traffic sniffer - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** MIT - **Source archive:** - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - sniffer (cli) - sniffer (alias) ## Build dependencies - go ## Uses from macOS - libpcap ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, sonoma, ventura, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 0.6.3 - Local data: ok - Upstream repository: https://github.com/chenjiandongx/sniffer - Upstream latest detected: v0.6.3 (current) - info: No package-manager update timestamp was available. ## Project history and usage sniffer is a terminal network traffic analyzer written as a modern alternative to tools such as bandwhich and nethogs. It uses libpcap through gopacket and presents process and connection traffic in a responsive TUI. ### Project history The public GitHub repository was created in 2021. The official README describes a troubleshooting tool that can be started on demand without loading kernel modules and can capture traffic across Linux, macOS, and Windows-specific process matching approaches. ### Adoption history The project has a narrower packaging footprint than the older networking tools it references. The supplied package facts list Homebrew packaging, while the README documents Go installation and Homebrew installation on macOS. ### How it is used Users run sniffer with flags for BPF filters, device prefixes, refresh interval, view mode, DNS resolution, and traffic units. The README documents bytes, packets, and plot modes plus terminal hotkeys. ### Why package nerds care sniffer is notable as a small Go CLI that still depends on platform packet-capture facilities: libpcap on Unix-like systems and npcap on Windows. That makes it a packaging example where a statically built Go binary still has native capture prerequisites. ### Timeline - 2021: Public GitHub repository created. - 2021: README links an introductory article dated 2021-11-17. - 2025: GitHub metadata shows repository updates after initial release. ### Related projects - The official README names gopacket, libpcap, bandwhich, nethogs, ss, lsof, gopsutil, npcap, and iperf as related tools or dependencies. ### Sources - - - source_facts.package-manager ## Security Notes broad file, network, media, or database tool signal. escape, surveillance, or offensive capability signal. - **Geiger risk:** red / medium - broad file, network, media, or database tool signal - escape, surveillance, or offensive capability signal ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** sniffer - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Related links - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [dnstop](https://www.automicvault.com/pkg/brew/dnstop/) - Shares av.db curated category or tags: cli, monitoring, networking, packet-capture, traffic-analysis. - [fprobe](https://www.automicvault.com/pkg/brew/fprobe/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking, traffic-analysis. - [miruo](https://www.automicvault.com/pkg/brew/miruo/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking, pcap. - [ntopng](https://www.automicvault.com/pkg/brew/ntopng/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking, traffic-analysis. - [rustnet](https://www.automicvault.com/pkg/brew/rustnet/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking, tui. - [sniffnet](https://www.automicvault.com/pkg/brew/sniffnet/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking, traffic-analysis. - [bmon](https://www.automicvault.com/pkg/brew/bmon/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking. - [bwm-ng](https://www.automicvault.com/pkg/brew/bwm-ng/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking. - [httpflow](https://www.automicvault.com/pkg/brew/httpflow/) - Local package facts share a topical domain. Shared terms: analysis, capture, cli, networking, packet. ## Combined YAML source View the package source record on GitHub. [combined/sniffer.yml](https://github.com/automic-vault/db/blob/main/combined/sniffer.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - cross-ecosystem install command graph