Little Snitch 1

Tips & Tricks

  • Avoid adding "Deny" rules to Little Snitch if you can find an option in the application to disable the network activity. This makes it easier to keep control of all the rules.
  • If you don't recognize an application named in Little Snitch's alert panel, click on the application icon to see the full file system path and the Unix process ID.
  • You can change the sort order of rules by clicking on the column header of the table. By sorting, you can group rules by application, by Internet address, by port number, by protocol or by the action taken.
  • Little Snitch will try to display the name of the destination machine. This is done by means of a reverse lookup from the Internet address. This has two possible implications:
    1. If a machine has no reverse mapping, the address is displayed numerically.
    2. The reverse mapping may be different from the conventional name of the computer. An Internet provider may publish the mail exchanger as mail.provider.com, but register it as server1.provider.com in the reverse mapping tables.
  • The table of rules always lists Internet addresses of computers only. If you want to see the name of the computers, click on the entry to see the name below the table.
  • Adding rules for peer to peer applications like Acquisition, Limewire, etc.
    Since p2p applications are creating many connections to different hosts on different ports it is not practicable to create a rule for each host or port. Instead only deny those connections you don't like e.g. connections to port 80 or connections to some bad hosts. To avoid further Little Snitch alerts create an additional rule which allows any connection from your p2p application.
  • More specific rules override general rules, regardless of their order in the listing.
    • A rule for a particular application overrides a rule for "any" application.
    • A rule for a particular Internet address overrides a general rule.
    • Only the first rule which matches is applied.
    • If no rule matches, the Little Snitch alert panel appears.
  • Little Snitch allows all traffic in local networks whereas "local network" stands for your home or company network. You can change this behavior by editing the rules for "local network". All network interfaces are automatically detected also airport and PPP modem connections.