Little Snitch Help

Anatomy of a rule

The filtering behavior of Little Snitch is defined by a set of rules. A rule consists of three parts:

If a connection attempt matches the condition of a rule, the rule’s action will be performed. If more than one rule matches a particular connection attempt, the one with the highest precedence will be used.

Condition properties

The condition properties of a rule define on which condition the rule matches a connection. They are analogous to their connection counterparts.

Connect direction

A rule can match either outgoing or incoming connections. An outgoing connection is when a process on your computer initiates a connection to somewhere else. In the metaphor of the phone call, your computer dials a phone number to call somebody else. An incoming connection, on the other hand, is when a remote computer initiates a connection to a process on your computer. Your computer acts as a server in this case. In the metaphor of a phone call, this is when your phone rings and you accept a call.

Process

A process is an application (an “app”) with a graphical user interface, a background process (Unix daemon) needed by the system to perform certain tasks (e.g. sync your data to the cloud) or a Unix command with no graphical user interface. Processes are matched by their file system path (where they are stored on your disk).

Applications may execute Unix commands to do things on their behalf. If Little Snitch encounters a Unix command which has been started by an Application, it shows both the Unix command and the Application, e.g. "Terminal via ping". Rules matching the application will match this combination as well. However, you can also create rules which match a particular combination of application and Unix command only (via-rules).

Code signature requirement

If this property is set, the rule matches only if the process has a valid code signature. For particular processes (not “Any Process”), an identification of the developer who signed the code is also stored and the rule matches only if the currently running process is signed by the same developer.

Note that a code signature requirement is only set for allow rules. Deny rules are effective even if the process was maliciously modified.

Process owner

Processes have an owner. The owner is usually the user who started the process. This user can also be the operating system (denoted as “System” by Little Snitch). Processes started by a user can gain system privileges by asking for an admin login.

Processes owned by the system are often of particular importance because they provide services for all users on the computer, not just for you. Rules matching processes owned by the system are therefore global, they are shared by all users. To handle various tasks, the system uses many different users that Little Snitch all considers system users. These are essentially all user accounts with user IDs below 500, except 201 (guest user) and -2 (nobody).

When Little Snitch shows a connection alert for a system process, it prepends the process name with a gear wheel icon:

System process indication

The same icon is used to flag rules matching system processes only.

In addition to matching processes owned by the current user (“me”) and the system, Little Snitch rules can also match processes owned by anyone. These rules are called global rules, show up in all users’ rule sets and also match processes owned by the system. Since rules of this type have an effect on all users, the permission to create them must be enabled in Little Snitch Configuration. Open Little Snitch Configuration > Preferences > Security and turn on “Allow Global Rule Editing”.

Server (remote computer)

This property can be one of:

While all of these options can be used to match outgoing connections, incoming connections cannot be matched by name or domain because the remote name is never known reliably.

Protocol

A rule can match on particular protocols only (usually TCP, UDP or ICMP) or on any protocol. Learn more about protocols…

Port

Some protocols have a port number for each end of the connection. For outgoing connections, the rule matches if its port matches the connection’s remote port. For incoming connections, the rules’s port must match the local port where the connection is accepted.

Rules can match either a single port or a range of port numbers (e.g. 137-139) or any port.

Profile

A rule may be effective only when a particular profile is active. If this property is not set, the rule is effective in all profiles. Although this property has no connection counterpart, it is part of the condition under which the rule matches.

Enabled

Rules can be enabled or disabled. Disabled rules never match, they behave as if they had been deleted. However, the information stored in the rule is not lost, the rule can be re-enabled at any time. This property is particularly useful for protected rules (they cannot be deleted) or if you want to test what effect it would have if a particular rule were deleted.

Action property

The most important non-matching property: What to do when the rule matches. Can be allow, deny, ask for or private. If the action is ask for, Little Snitch behaves basically as if no rule had matched. It prevents rules with lower precedence from matching and a connection alert is shown (unless Silent Mode is active).

Rules with action private have no effect on the network filter. They determine whether individual connection statistics are collected by Network Monitor. If a rule with action private matches, Network Monitor adds statistics to an item named Private Connections, not revealing the remote server name, Internet address or other connection data.

Other properties

Lifetime

Rules can be set to expire at a particular time or event. This property describes when the rule expires. Possible options are

Priority

If this property is set, it lifts the rule’s precedence over all other rules that don’t have it. We recommend that you use priority rules sparingly and only in profiles.
Learn more about rule precedence of rules in the rule set…

Notes

You can add a note to every rule, e.g. describing the purpose of the rule. Factory rules come with a description of the rule’s purpose. Rules created via connection alert or Network Monitor get a note with a summary of the connection shown in the alert or in Network Monitor by default. You can edit factory descriptions and automatically created descriptions at will.

Creation date

Automatically set when the rule is created.

Protected

Protected rules cannot be edited, but they can be disabled. Little Snitch Configuration uses a lock icon to indicate a protected rule.

There are two kinds of protected rules:

Unapproved

Rules created outside of Little Snitch Configuration are tagged as unapproved. As a preferences option (preferences section “Advanced”), rules created via connection alert or Network Monitor can be set to be approved right away. To approve a rule, right-click it and choose “Approve” from the context menu. If the preferences option “Approve rules automatically” (also in the ”Advanced” section) is active, rules are approved by simply selecting them.


Was this help page useful? Send feedback.
© 2016-2019 by Objective Development Software GmbH