Picosnitch

Receive notifications whenever a new program connects to the network, or when it's modified Monitors your bandwidth, breaking down traffic by executable, hash, parent, domain, port, or user over time Can optionally check hashes or executables using VirusTotal Executable hashes are cached based on device + inode for improved performance, and works with applications running inside containers Uses BPF for accurate, low overhead bandwidth monitoring and fanotify to watch executables for modification Since applications can call others to send/receive data for them, the parent executable and hash is also logged for each connection