Search and filters

The search field performs a textual substring search in all items of the connection list. By default, it searches in process names and server names and supports a limited set of keywords

Search term — Enter any text here in order to search for it in the connection list.
Search menu — Insert special keywords to search only in particular properties of connections. See examples below.
Filter menu — Filter connections by properties which are better expressed in a menu than a search string.

Search term examples

cloud — Finds the cloudd process with all its connections and all processes connecting to hosts in domain icloud.com. It may find more cloud-related connections and processes in your list, e.g. owncloud or similar.
"Little Snitch" — (Including the double quotes) finds various processes related to Little Snitch, e.g. Little Snitch Software Update and Little Snitch Helper. It searches for the exact quoted term including the space, so it won’t find connections to www.littlesnitch.com.
process:cloud — Finds cloudd and other processes containing the word “cloud”, but it won’t find connections to servers in the domain icloud.com.
country:"united states" — See all connections to servers located in the United States. The search term must be quoted because it contains a whitespace character.

Click the search menu to see more of the supported query prefixes.

When multiple search strings are entered, only items matching all the strings are found. Exception: Multiple search expressions for geographic locations of the same level match if any of the location expressions match.

Filter menu

The filter menu adds filters for the following properties. When a filter is active, the menu button is highlighted.

Unconfirmed — Show only connections which occurred during Silent Mode and are not covered by a rule.
Allowed — Show only connections allowed by your current rule set.
Denied — Show only connections denied by your current rule set.
Incoming — Show only connections initiated by an external computer.
Outgoing — Show only connections initiated by a process on your computer.
From Now — Show only connections which have any activity after the moment you choose this option.

If you want to see what new connections occur as a consequence of an action, choose the From Now filter from the filter menu (keyboard shortcut Command-K). Immediately after setting this option, the connection list is empty and connections appear as they occur. Perform the action in question (e.g. load a web page) and see in realtime how connections are made.

Local network connections

One filter is active by default: Connections to devices in your home or office, e.g. your printer, scanner, network attached storage, router etc. are not shown. If you want to see them, choose from the main menu View > Show Local Network. This filter also acts on the traffic meter shown in the status menu.