One small suggestion, consider using tcpdump on your router to make sure LS is really stopping everything. Apple and Microsoft wised up to this some time ago a

One small suggestion, consider using tcpdump on your router to make sure LS is really stopping everything. Apple and Microsoft wised up to this some time ago and some things hook in the network stack after the application firewalls. If you spot something please report it to the Little Snitch developers. The amount of data captured by tcpdump can be minimized by only capturing syn/fin/rst packets assuming proto 6 tcp. 'tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0' And if capturing to a file one can also limit the total number of packets captured with -c 1000 This may be useful if you are also capturing proto 17 udp.