How rules work

A network connection has two ends: a process on your Mac, usually an app, and a server somewhere on the internet or in your local network. A rule tells Little Snitch whether to allow or deny connections between them. For example:

Allow Mail to connect to imap.gmail.com.
Deny Safari connections to doubleclick.net.
Allow Software Update to connect to any server.

So a basic rule answers three questions: which process, which server, and what to do. When a process establishes a connection, Little Snitch looks for a rule that matches both the process and the server, and does what the rule says. If no rule matches, the operation mode decides: Little Snitch either asks you or handles the connection silently.

That’s all most rules need. But a rule can also look at more details of a connection, such as its port or its direction, and it can do more than allow or deny. These finer points come later on this page, after the basics.

Which process

Little Snitch needs to recognize the process reliably, so that a rule for Safari matches Safari and nothing that only pretends to be Safari. That’s why a rule usually identifies the process by its Code ID, which usually comes from the app’s code signature. The Code ID stays the same when you move the app to a different folder or install an update, so the rule keeps working.

In rare cases, a rule identifies the process by its path in the file system instead. By default, Little Snitch then also checks the code signature of the executable at that path, to make sure that nobody replaced it. You can turn this check off for the rule.

Instead of a particular process, a rule can also match any process at all (Any Process), or a whole group of processes, such as all processes of the Unix core of macOS (Any macOS Process).

Helper processes

Some apps don’t connect on their own, but let a helper process establish the connection on their behalf. When you use ping in a Terminal window, for example, it’s ping that connects, on behalf of Terminal. Little Snitch shows this as “Terminal via ping”.

A rule for Terminal matches such connections, so you don’t need to know about the helper. But if you want to treat them differently from Terminal’s other connections, you can make a more specific rule for “Terminal via ping”.

Which server

The part of a rule that says which servers it matches is called the remote endpoint. In the rule editor, it’s the setting To:. Most rules use one of these:

Domains: Matches all servers in the domain. A rule for apple.com, for example, matches www.apple.com, support.apple.com, apple.com itself, and every other server whose name ends in .apple.com. That’s usually the best choice, because most services use several servers.
Hostnames: Matches only servers with exactly this name, such as imap.gmail.com.
IP addresses: Matches servers by their IP address. You can enter single IPv4 and IPv6 addresses, and ranges of them.
Any Server: Matches all servers.

A rule can list several domains, hostnames, or IP addresses.

To match a domain or a hostname, Little Snitch needs to know the server’s hostname. For an incoming connection, it can’t know it reliably, so rules for domains and hostnames match only outgoing connections. See Direction.

For connections within your local network, there are some special kinds of remote endpoints:

Local network: Matches computers on private networks, as well as broadcast and Bonjour addresses. At home, that’s your printer, your router, and your other computers. In a public network, such as in a café, it also matches the computers of everybody else there.
Broadcast addresses: Matches the address that reaches all computers in your local network at once. Computers use it mostly to discover printers, shared folders, and other services.
Bonjour addresses: Similar to broadcast addresses, also for discovering services in your local network.
Multicast addresses: Matches a special range of IP addresses that computers use to send data to several computers at once. These computers aren’t necessarily in your local network.

Finally, there’s one remote endpoint that isn’t a server at all: the Berkeley Packet Filter. It’s a low-level service of macOS that lets a process monitor all network traffic of your Mac, and even of other computers in your network, or send and receive any kind of network packet. A rule for the Berkeley Packet Filter decides whether a process may use it.

What the rule does

The action of a rule says what Little Snitch does with a matching connection:

Allow: Little Snitch lets the connection through.
Deny: Little Snitch denies the connection, and the app gets a network error.
Ask: Little Snitch holds the connection and shows a connection alert, just as in Alert Mode when no rule matches. That’s useful if you want to decide case by case, for example for an app that you rarely use.

Rules can also play a sound, show a notification, or hide connections in Network Monitor. These actions are rarely needed, see Other actions.

More conditions

Process and server are enough for most rules. But a rule can be more specific, and match a connection only if further details match too.

Direction

Usually, the process on your Mac establishes the connection: that’s an outgoing connection. But sometimes a server establishes a connection to your Mac: that’s an incoming connection. Incoming connections occur mostly when your Mac provides services to other computers, such as file sharing or screen sharing. Either way, once the connection is established, data flows in both directions.

A rule applies either to outgoing connections, to incoming connections, or to both. In the rule editor, you choose Outgoing, Incoming, or Any Direction.

Port

A server can offer several services at the same time, and each service has its own port number. A web server, for example, usually accepts secure connections on port 443 (HTTPS), and a mail server for incoming mail on port 993. A rule can match any port, or only particular ports: a list of port numbers and ranges, such as 20-30, 80, 443.

For an outgoing connection, Little Snitch compares the rule with the server’s port. For an incoming connection, it uses the port on your Mac that accepts the connection.

Protocol

A rule can match any protocol, or only a particular protocol, such as TCP, UDP, or ICMP.

Process owner

Every process runs under a user account. Usually, that’s the account of the person who started it, for example yours. But some processes provide services to all users of your Mac and run under a special account of the operating system. Little Snitch calls their owner “System”. More precisely, it counts all accounts with a user ID below 500 as system accounts, except 201 (the guest account) and -2 (nobody).

A rule matches the processes of one of these owners:

Me: Only your own processes.
System: Only system processes.
Anyone: The processes of all users and of the system.

Rules for System and for Anyone affect all users of your Mac, which is why they’re called global rules. Rules for Me affect only you.

If the setting Allow Global Rule Editing in the Security settings is off, Little Snitch asks for the name and password of an administrator before you can change a rule for Anyone. Rules for System are global too, but every user can create, change, and delete them, because many apps rely on system services, and users need these rules to manage the connections of their own apps.

Little Snitch marks system processes, and rules for them, with a gear icon . For example, here in the connection alert:

System process indication

Profile

A rule can belong to a profile, so that it applies only while this profile is active. A rule without a profile applies in all profiles. Unlike the other conditions, this one doesn’t look at the connection: it decides whether Little Snitch considers the rule at all.

Enabled

You can disable a rule. A disabled rule never matches, as if you had deleted it. But Little Snitch keeps it with all its settings, so you can enable it again at any time.

Other actions

Besides allowing, denying, and asking, a rule can do two more things:

Notify you: Play Sound plays a sound that you choose, and Show Notification shows a notification in the top right corner of the screen. You choose whether the rule reacts to allowed connections, denied connections, or both. That’s useful if you want to know when a particular app connects, for example.
Hide connections: Hide removes the matching connections from Network Monitor and doesn’t record their history. Network Monitor still counts their traffic, in a single row named Hidden Connections. That’s useful for connections that you don’t want to see, for privacy or to reduce clutter.

These actions work independently of allow, deny, and ask. A connection can be allowed by one rule, for example, and trigger a notification from another rule at the same time.

More about a rule

Besides conditions and an action, a rule has a few more settings and some information about itself. The Inspector of the Rules window shows them, such as your notes and when the rule was created and last changed.

Lifetime

Most rules are permanent: they stay until you delete them. A temporary rule, on the other hand, expires, and Little Snitch deletes it automatically:

When the process quits.
When you log out.
When your Mac restarts.
After a given time, for example after five minutes.

Unapproved

An unapproved rule is a new rule that you haven’t looked at yet. Rules that you create in the rule editor are always approved. Rules from other sources, such as the connection alert or a remote rule group, can start out unapproved, see Advanced settings.

Protected

You can’t change or delete a protected rule, but you can disable it. The Rules window marks protected rules with a lock icon .

When several rules match

Often, more than one rule matches a connection. Say one rule allows Safari to connect to any server, and another one denies Safari connections to doubleclick.net. When Safari connects to doubleclick.net, both rules match. In such a case, the more specific rule wins: here, the deny-rule, because it names a particular domain.

Little Snitch picks a winner separately for each kind of action: one rule that allows, denies, or asks, one rule that notifies you, and one rule that hides the connection.

To decide which of two rules is more specific, Little Snitch compares them step by step. The first step that finds a difference decides:

If the priorities differ, the rule with the higher priority wins.
Little Snitch compares the kinds of remote endpoints. The rule with the kind of higher precedence wins. From high to low:
- IP addresses or ranges of IP addresses
- Full hostnames or lists of hostnames
- Domain names or lists of domain names
- Broadcast addresses
- Multicast addresses
- Bonjour addresses
- Local Network addresses
- Any Server
- Berkeley Packet Filter: Its position doesn’t matter, because it can’t match the same connection as any of the kinds above.
If the remote endpoints are of the same kind, Little Snitch compares them in more detail. Shorter lists win over longer lists, and smaller ranges over larger ranges. Domains with more labels win over domains with fewer labels: www.example.com wins over example.com.
The rule that matches fewer ports wins. Any Port counts as 0-65535.
A rule for a particular protocol wins over a rule for Any Protocol. (Rules for two different protocols can’t match the same connection.)
Rules for a particular process win over rules for Any Process.
Rules for a process via a helper process (process via helper) win over rules for a single process (process only or helper only).
Rules for a particular Process Owner win over rules for Anyone. (Rules for two different owners can’t match the same connection.)
Rules for one direction win over rules for both directions.
Deny-rules win over allow-rules.
Allow-rules win over ask-rules.

Priority

For almost all rules, the steps above work out the right winner on their own, so you don’t need to think about priority. In rare cases, though, you want a rule to win that would otherwise lose. For this, you can increase the priority of the rule (Increase Priority). A rule with high priority wins over all rules with normal priority, however specific they are.

A typical case is a blocklist that blocks a server that one of your apps needs. A blocklist entry applies to Any Process, but it still wins over most rules for a particular app, such as a rule that allows the app to connect to any server. To let just this app connect to the server, create a rule that allows it, and increase its priority.

Use high priority sparingly, only when you can’t solve a problem any other way. The more rules have high priority, the harder it gets to understand why a particular rule wins.

Little Snitch itself can also create a rule with extra-high priority. It denies all connections of a process after its identity check failed, see Process modification warning, and it wins over all other rules.

Blocklists

For precedence, Little Snitch treats every blocklist entry as a deny-rule with normal priority for Any Process, any port, and any protocol:

An IP address entry ranks like a rule for a single IP address.
A domain or hostname entry ranks like a rule for outgoing connections to a domain with two labels, such as example.com, however many labels the entry actually has.

That’s why blocklists win over most rules, for example over a rule that allows a process to connect to Any Server. To make an exception, use a rule with high priority, or a rule for a hostname or for IP addresses.

Sort by precedence

Working out by hand which rule wins can be tricky. The Rules window can do it for you:

In the rule list, click the Rule header.
Choose Sort by Precedence.

Rules higher up in the list win over the rules below them. To see only the rules that can match a particular process, use focus mode.