evilsocket / evilsocket/opensnitch

[Bug Report] Incorrect process detected

Open
#1,526 11 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
Python
Stars
14.1k
Forks
665
PR merge metrics
No merged PRs in 30d

Description

### Describe the bug:
I haven't been able to reproduce this issue precisely, but I've seen it several times: when the GUI shows consecutive connection attempts from a process that would absolutely never connect to those domains (e.g. a brokerage API gateway trying to connect to WhatsApp or Meetup).

Include the following information:
- OpenSnitch version: 1.8.0
- OS: Ubuntu 24.04
- Window Manager: KDE
- Kernel version: `6.14.0-123037 #37~24.04.1tux2 SMP PREEMPT_DYNAMIC Fri Jan 23 22:31:21 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux`

### To Reproduce:

Steps that exhibited the behavior:
1. In a browser, open tabs for sites that initiate connections in the background: Facebook, WhatsApp, Meetup, LinkedIn, YouTube
2. Don't create rules for these sites. Create a rule to allow everything from the browser command line for a duration (I used 12h, but hopefully 5m will reproduce the issue)
3. Have some other applications running. In my case I have [this brokerage API](https://www.interactivebrokers.com/campus/ibkr-api-page/cpapi-v1/#how-to-gateway), which works without needing a broker account
4. (Leave the machine unattended) After the duration above, the browser may initiate connections to Facebook, WhatsApp, Meetup domains
5. OpenSnitch may display these as originating from the other application.

### Screenshots:

Image
Image
Image

### Additional context:

Maybe #1315?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.