Search and filters
The search field performs a textual substring search in all items of the Connection List. By default, it searches in process names and server names and supports a limited query language similar to Google Search.
- Search Term — Enter any text here in order to search for it in the Connection List.
- Search Menu — Insert special query language tokens to search only in particular properties of connections. See examples below.
- Filter Menu — Filter connections on properties which are better expressed in a menu than a search string.
Search term examples
cloud— Finds the
clouddprocess with all its connections and all processes connecting to hosts in domain
icloud.com. It may find more cloud-related connections and processes in your list, e.g.
"Little Snitch"— (Including the double quotes) finds various processes related to Little Snitch, e.g.
Little Snitch Software Updateand
Little Snitch Helper. It searches for the exact quoted term including the space, so it won’t find connections to
clouddand other processes containing the word “cloud”, but it won’t find connections to servers in the domain
country:"united states"— See all connections to servers located in the United States. The search term must be quoted because it contains a whitespace character.
Click the Search Menu to see more of the supported query prefixes.
When multiple search strings are entered, only items matching all the strings are found. Exception: Multiple search expressions for geographic locations of the same level match if any of the location expressions match.
The filter menu adds filters for the following properties. When a filter is active, the menu button is highlighted.
- Unconfirmed — Show only connections which occurred during Silent Mode and are not covered by a rule.
- Denied — Show only connections denied by your current rule set.
- Incoming — Show only connections established by an external computer (something “calling in” to a process).
- Outgoing — Show only connections established by a process on your computer.
- Time Limit — Show only connections which had any activity recently.
- Since Timestamp — Show only connections which have any activity after the moment you choose this option.
If you want to see what new connections occur as consequence of an action, choose the Since Timestamp filter from the filter menu (keyboard shortcut ⌘+K). Immediately after setting this option, the Connection List is empty and connections appear as they occur. Perform the action in question (e.g. load a web page) and see in realtime how connections are made. Then make a Snapshot (⌘+D) and analyze the connections.
Local network connections
One filter is active by default: Connections to devices in your home or office, e.g. your printer, scanner, network attached storage, router etc. are not shown. If you want to see them, choose from the main menu View > Show Local Network. This filter also acts on the traffic meter shown in the status menu.
Was this help page useful? Send feedback.
© 2016-2022 by Objective Development Software GmbH