---

name: little-snitch description: Control Little Snitch firewall on macOS. View logs, manage profiles and rule groups, monitor network traffic. Use when the user wants to check firewall activity, enable/disable profiles or blocklists, or troubleshoot network connections.

Little Snitch CLI

Control Little Snitch network monitor/firewall on macOS.

Setup

Enable CLI access in Little Snitch → Preferences → Security → Allow access via Terminal

Once enabled, the littlesnitch command is available in Terminal.

⚠️ Security Warning: The littlesnitch command is very powerful and can potentially be misused by malware. When access is enabled, you must take precautions that untrusted processes cannot gain root privileges.

Reference: https://help.obdev.at/littlesnitch5/adv-commandline

Commands

Command	Root?	Description
--version	No	Show version
restrictions	No	Show license status
log	No	Read log messages
profile	Yes	Activate/deactivate profiles
rulegroup	Yes	Enable/disable rule groups & blocklists
log-traffic	Yes	Print traffic log data
list-preferences	Yes	List all preferences
read-preference	Yes	Read a preference value
write-preference	Yes	Write a preference value
export-model	Yes	Export data model (backup)
restore-model	Yes	Restore from backup
capture-traffic	Yes	Capture process traffic

Examples

View Recent Logs (no root)

littlesnitch log --last 10m --json

Stream Live Logs (no root)

littlesnitch log --stream

Check License Status (no root)

littlesnitch restrictions

Activate Profile (requires root)

sudo littlesnitch profile --activate "Silent Mode"

Deactivate All Profiles (requires root)

sudo littlesnitch profile --deactivate-all

Enable/Disable Rule Group (requires root)

sudo littlesnitch rulegroup --enable "My Rules"
sudo littlesnitch rulegroup --disable "Blocklist"

View Traffic History (requires root)

sudo littlesnitch log-traffic --begin-date "2026-01-25 00:00:00"

Stream Live Traffic (requires root)

sudo littlesnitch log-traffic --stream

Backup Configuration (requires root)

sudo littlesnitch export-model > backup.json

Log Options

Option	Description
--last <time>[m|h|d]	Show entries from last N minutes/hours/days
--stream	Live stream messages
--json	Output as JSON
--predicate <string>	Filter with predicate

Notes

• macOS only
• Many commands require sudo (root access)
• Profiles: predefined rule sets (e.g., "Silent Mode", "Alert Mode")
• Rule groups: custom rule collections and blocklists