log-traffic

$ littlesnitch log-traffic --help
usage: littlesnitch log-traffic [-hs] [-b <YYYY-MM-DD HH:MM:SS>] [-e <YYYY-MM-DD HH:MM:SS>]
  -h, --help
        Print a short help and exit.
  -b, --begin-date <YYYY-MM-DD HH:MM:SS>
        Optional. Where to begin reading logged traffic history. If not
        specified, no historic data is printed.
  -e, --end-date <YYYY-MM-DD HH:MM:SS>
        Optional. Where to stop reading logged traffic history.
  -s, --stream
        Optional, incompatible with --end-date. Stream live traffic statistics.

This command gives you access to the underlying data visualized by Network Monitor. You can specify a time range with --begin-date and --end-date or view live statistics with --stream (which can be combined with --begin-date). Output is in CSV format and the first row always represents the field names.

Each row represents statistics over the time interval since the previous row.

Field Name	Description
date	Start date of the time interval
direction	The string “in” for inbound connections or “out” for outbound
uid	UID of the communicating process
ipAddress	Remote internet address
remoteHostname	Remote computer name used to look up the IP address
protocol	Numeric Internet protocol (e.g. 6 for TCP, 17 for UDP)
port	Remote port number for outgoing connections, local port number for incoming
connectCount	How often new connections were established during the statistics time interval
denyCount	How often connection attempts were denied during the statistics time interval
byteCountIn	Number of bytes received during statistics time interval
byteCountOut	Number of bytes sent during statistics time interval
connectingExecutable	A string describing the executable of the process which established the connection
parentAppExecutable	If the connecting executable is not an application, Little Snitch tries to find a responsible application. If one is found, this string represents the parent app.