Search and filters

The search field performs a textual substring search in all items of the Connection List. By default, it searches in process names and server names and supports a limited query language similar to Google Search.

Search Term — Enter any text here in order to search for it in the Connection List.
Search Menu — Insert special query language tokens to search only in particular properties of connections. See examples below.
Filter Menu — Filter connections on properties which are better expressed in a menu than a search string.

Search term examples

cloud — Finds the cloudd process with all its connections and all processes connecting to hosts in domain icloud.com. It may find more cloud-related connections and processes in your list, e.g. owncloud or similar.
"Little Snitch" — (Including the double quotes) finds various processes related to Little Snitch, e.g. Little Snitch Software Update and Little Snitch Helper. It searches for the exact quoted term including the space, so it won’t find connections to www.littlesnitch.com.
process:cloud — Finds cloudd and other processes containing the word “cloud”, but it won’t find connections to servers in the domain icloud.com.
country:"united states" — See all connections to servers located in the United States. The search term must be quoted because it contains a whitespace character.

Click the Search Menu to see more of the supported query prefixes.

When multiple search strings are entered, only items matching all the strings are found. Exception: Multiple search expressions for geographic locations of the same level match if any of the location expressions match.

Filter menu

The filter menu adds filters for the following properties. When a filter is active, the menu button is highlighted.

Unconfirmed — Show only connections which occurred during Silent Mode and are not covered by a rule.
Denied — Show only connections denied by your current rule set.
Incoming — Show only connections established by an external computer (something “calling in” to a process).
Outgoing — Show only connections established by a process on your computer.
Time Limit — Show only connections which had any activity recently.
Since Timestamp — Show only connections which have any activity after the moment you choose this option.

If you want to see what new connections occur as consequence of an action, choose the Since Timestamp filter from the filter menu (keyboard shortcut ⌘+K). Immediately after setting this option, the Connection List is empty and connections appear as they occur. Perform the action in question (e.g. load a web page) and see in realtime how connections are made. Then make a Snapshot (⌘+D) and analyze the connections.

Local network connections

One filter is active by default: Connections to devices in your home or office, e.g. your printer, scanner, network attached storage, router etc. are not shown. If you want to see them, choose from the main menu View > Show Local Network. This filter also acts on the traffic meter shown in the status menu.