How hostnames are determined

The internet works with numeric addresses, but people prefer names. So a service translates names into numeric addresses, much like a phone book: the Domain Name System (DNS), a distributed, hierarchical database.

Little Snitch intercepts network traffic in a content filter network extension. At that point, it often knows only the numeric address, not the name. But your rules are mostly about names, so Little Snitch has to find the name that belongs to the address.

There is a “reverse phone book” for IP addresses, the reverse lookup, but it doesn’t help much here. A name can resolve to several IP addresses, and several names can resolve to the same IP address. The reverse lookup usually returns only one of the names of a computer, and rarely the one that the process used to connect.

So Little Snitch combines three methods to find the hostname of a server:

Information from the Network Extension framework

If an app connects through one of Apple’s high-level frameworks, macOS hands the hostname to the Network Extension of Little Snitch. That’s the easy case. With older (legacy) functions, macOS can’t always provide a hostname, and Little Snitch falls back on the other two methods.

DNS sniffing

Little Snitch watches all processes as they resolve names to addresses, and remembers which process knows which addresses. For each connection attempt, it looks at the IP address and at the process that uses it, and checks which name the process looked up to get that address.

If the process can know only one name for the address, Little Snitch uses that name. If the process resolved several names to the same IP address, Little Snitch needs to look more closely at the connection.

Deep packet inspection

Little Snitch isn’t the only one that needs to know hostnames. A content delivery network, for example, hosts many websites on the same IP address, but must deliver different content for each of them.

That’s why many protocols, such as HTTP 1.1 and newer, send the hostname in every request. If DNS sniffing didn’t produce a unique name, Little Snitch lets the process connect, regardless of your rules, and captures the first request that the process sends, without passing it on to the server yet. It examines the protocol headers. If it finds a hostname that is also among the sniffed names, it uses this name to match your rules. Depending on the result, it then either sends the held request to the server, or discards it and closes the connection. If Little Snitch finds no name, or a name that the process never looked up, it uses the IP address (see below).

Little Snitch does not intercept encrypted communication (SSL/TLS). It doesn’t need to: to get a hostname, reading the unencrypted Server Name Indication (SNI) header is enough.

Whether Little Snitch trusts the name in the SNI header is up to the option Verify server names asserted by process in the Security settings. With the option on, the name must also be among the sniffed names, as described above. With the option off, Little Snitch trusts the SNI header.

If Little Snitch finds no unique hostname

Sometimes Little Snitch can’t find a unique name. That happens when both of these are true:

The process looked up several names that resolve to the same IP address.
The connection doesn’t reveal a hostname, because its protocol doesn’t send one or the SNI header is encrypted.

Little Snitch then has a set of names instead of one name. In this case, it uses the IP address to match your rules, and shows this address in connection alerts and in Network Monitor.

It also checks whether all of the names are in the same domain, such as www.google.com, books.google.com, and maps.google.com. If they are, and a rule for this domain matches, Little Snitch applies it. If the names aren’t in the same domain, or no rule matches, Little Snitch shows a connection alert with the warning Hostname could not be determined, which lists the hostnames that Little Snitch knows for the IP address.

Incoming connections

An incoming packet can be a connectionless response to an outgoing request, for example with protocols that use UDP. Little Snitch counts such a packet as received data of the outgoing request and treats the exchange like a connection.

For all other incoming connections, Little Snitch has no way to find a hostname. It knows only the IP address of the server, so it always shows incoming connections with their IP address.