MatrixNet
Little Snitch meets Wireshark — passive & open source
11 followers
Little Snitch meets Wireshark — passive & open source
11 followers
A passive macOS network monitor that unites two tools in one native app: per-app monitoring (which app connects where) + packet-level dissection (what's actually on the wire), with a correlation layer tying every captured packet back to its process. 100% passive — no NetworkExtension, no proxy, no HTTPS interception — so it runs alongside any VPN, proxy or filter without conflict. JA4 fingerprints, IPv4/IPv6 GeoIP map, threat flagging, and a desktop widget. Open source, Apache-2.0.
Curious how this handles HTTPS without actually intercepting anything - does the JA4 fingerprinting mean you're still doing some TLS handshake inspection, or is the packet-level view limited to just the metadata and headers?
@etinynylac4u
MatrixNet is strictly passive. It reads packets read-only off a BPF tap on Apple's PKTAP interface — it's never in the data path, so it can't (and doesn't) terminate, proxy, or decrypt a single TLS session.
JA4 is computed only from the ClientHello, which the client sends in the clear before any session key exists. So it's "handshake inspection" only in the sense of reading fields that were already plaintext: the offered TLS version, cipher suites, extensions, signature algorithms, and ALPN, plus whether SNI is present. That's exactly what the JA4 hash is built from — no key exchange is touched. (The SNI hostname itself is plaintext in the same ClientHello, which is how you get the destination name of an HTTPS flow with zero decryption.)
Everything after the handshake — the encrypted application data — stays fully opaque. For those records the packet view is exactly what you'd expect from passive capture: 5-tuple, direction, size, timing, and the TLS record framing — never the plaintext. So it's both at once: a handshake-derived fingerprint layered on top of pure metadata.
finally something that shows the process and the raw packet on the same row, which is exactly what i wanted from little snitch without the nag popups. the passive approach actually working alongside my tunnel is a relief
@betlf4xj
The process-on-the-same-row part comes from Apple's PKTAP, which tags every packet with the PID that sent it at the kernel level, so attribution isn't a heuristic bolted on afterward — the process and the raw bytes arrive together.
The "no nag popups" bit is a direct consequence of being observe-only: there's no connection-approval hook anywhere, nothing to allow or deny, so nothing that can interrupt you. It watches; it never gates traffic.
And the reason it coexists with your tunnel instead of fighting it: MatrixNet uses zero NetworkExtension / content-filter / system-extension machinery. Tools that fight over your tunnel do so because they're trying to sit in the same packet-filter slot your VPN wants. MatrixNet just sits beside it and watches — it can even show you the per-app traffic inside the tunnel, without ever competing for the data path. Relieved that it's working for you 🙏