Is there a way to run opensnitch in passive mode for network monitoring?

[shraupad]

Hi,

I have a two machine setup - one machine running the server (GUI) and the other running the daemon.

I'd like to use opensnitch as a tool to only monitoring traffic on the machine running the daemon. What this means is opensnitch should start off as a passive listener allowing all traffic and just reporting the connections. I understand I can configure rules to do this on the UI, but this works only after a node is connected. I was wondering if there was a way to configure this as a default behavior at startup before a node is connected? (i.e I dont want any pop-ups asking the user to allow/deny/reject)

Appreciate any inputs. Thanks!

[gustavo-iniguez-goya]

hi @shraupad ,

opensnitch should start off as a passive listener allowing all traffic and just reporting the connections.

Set DefaultAction to "allow" in /etc/opensnitchd/default_config.json . This option only takes effect when the node is not connected to the GUI.

See the notes regarding this option: https://github.com/evilsocket/opensnitch/wiki/Configurations

When the node connects to the GUI, the GUI applies its own DefaultAction You can configure it from Preferences -> pop-ups -> Action.

You can also disable the pop-ups from the Preferences dialog.