Reasons to prefer Little Snitch over the built-in firewall

firewallNetwork

Every now and then I browse through software you must have on your mac type lists and more often than not somebody mentions Little Snitch as a must-have application.

Now what I think that many people ignore or aren’t aware of is that in fact OS X itself has an application firewall built-in (though hidden and the application layer inactivated).

I understand that Little Snitch maybe allows for a more fine-grained selection of ports and one may exclude only specific addresses from the traffic per application. However, I wonder if this is really needed for the average (and better-than-average) type of desktop user.

So my question would be in which cases is the built-in firewall not sufficient and when would one have to choose an external tool like Little Snitch.

(Note: I’m not speaking about controlling the traffic in a web or database server setup in which cases I thoroughly understand blocking certain connections whilst allowing only a small set.)

Best Answer

Little Snitch offers three features that aren't available in MacOS' built-in ipfw firewall. (It does this by loading a custom kernel module.)

  1. Little Snitch allows you to block outgoing connections; the MacOS firewall only blocks incoming connections. Handy if you're running some untrusted program and aren't sure what it's going to do, or if you want to disable a program for updating itself, or if you want to prevent access to a specific resource. Also, I suspect many people use Little Snitch to block pirated software from checking their license.
  2. Little Snitch lets you configure the firewall per application, not just address or port. Ie: you can configure it so one web browser can access a web site but not another.
  3. Little Snitch also monitors network traffic on a per-application basis. It's easy on MacOS to see how much bandwidth you're using but much harder to see which program is using that bandwidth. The Little Snitch shows network usage for each application, albeit in a limited way.

That being said, I don't think Little Snitch is "must have" software; these features are fairly esoteric. There are also several alternatives: TCPBlock and glowworm for the firewall and Rubbernet (now defunct) for the monitoring.

2016 Update: MacOS now has the per-application monitoring built into Activity Monitor.

Related Question