I've used both, they're a good start, but any sophisticated rootkit will be able to work under the hood and these tools won't detect it. Also some malware funct

I've used both, they're a good start, but any sophisticated rootkit will be able to work under the hood and these tools won't detect it. Also some malware functionality can be injected into legit processes that make use of the network and appear invisible to these filters eyes. http://www.arbingersys.com/osx-injection-override-tutorial-hello-world/ http://www.arbingersys.com/osx-injection-override-tutorial-h... If you really want to monitor what's going in&out of your computer you'll need to use wireshark from other computer in your network... =)