[imglorp]

I've been messing with a little kernel module to do that by logging all new IP connections. Having it there lets you watch all your applications for unwanted traffic. You could layer a policy/reporting/blocking layer in userspace.

Surely there's already something to do this aside from a full sniffer?

[peteretep]

Sure, something like LittleSnitch on the Mac is an interactive and easy-to-use firewall. But I'm really after something that is looking for things you could write easy filters for:

- Tell me whenever something that looks like an email address is sent in the clear

- Tell me whenever my name/postcode/other user-specifiable text is sent in the clear

- Tell me when I'm connect to an SSL site but the hostname is leaked

- Keep a list of DNS entries that I'm leaking

The real challenge will not be to capture everything, it'll be trying to show up items of interest.