Sniffnet and AI agents: a measurement protocol still to run

Correction, September 16, 2026. The previous title promised to show how much traffic my agents generated, but the article supplied no measurements. It also claimed an installation without attached evidence and exposed internal generator markup. This version withdraws those claims and presents the work as a proposed experiment.

The question to answer

What changes in a machine's traffic when an agent moves from idle to executing a specific task? That question requires comparable observations. Opening a monitor and looking at a graph is not enough to attribute traffic to a tool.

Sniffnet is the proposed project for this observation. Before testing, verify its version, platform and available measurements. This article does not assume that it identifies processes or reads the contents of encrypted connections.

Proposed protocol

1. Record the operating system, Sniffnet version, observed interface, agent, model and task.
2. Define equal intervals for baseline idle, agent open without a task, and agent executing the task.
3. Close unrelated applications or record their activity as potential interference.
4. Where supported, save sent and received bytes, duration and observed destinations for each interval.
5. Repeat the conditions and retain original observations, including runs that contradict the hypothesis.

Use the same interface and duration for comparisons. A destination shared by several applications does not establish which application generated the traffic; that attribution needs additional evidence.

What I would publish afterward

A table of runs, conditions and results; capture limitations; and an explanation of what can be attributed and what remains uncertain. Network bytes are also not a direct measure of billed tokens: that comparison would require the provider's usage record.

My position is that a small documented experiment is more useful than a first-person account without data. Current status: proposed protocol, no published results.