All this information is required in order to write a valid PCAP file. It is also not known whether and how the data will be fragmented into packets.

At this layer, however, it is not yet known via which network interface the data will be routed (which sender Internet address will be used) and sometimes it is not known which sender port number will be used. This is what distinguishes Little Snitch from conventional firewalls, after all. In order to understand the results of a traffic capture, you must know that Little Snitch intercepts traffic at the application layer, not at the network interface layer as other sniffers do.

To stop a running capture, you can either click Little Snitch’s status menu item (where a red recording indicator is blinking) and choose Stop Capture of … or right-click the connection being captured in the Connection List and choose Stop Capture from the context menu. Little Snitch can run any number of simultaneous traffic captures. Little Snitch starts capturing immediately while you choose a name for the file. To start capturing traffic of a certain process, right-click the process in Network Monitor’s Connection List and choose Capture Traffic of … from the context menu. Network Monitor offers an option to record all traffic for a particular process in PCAP format.

Filtering out the relevant data is tedious. You can use a network sniffer like Wireshark, but these tools record traffic of your entire computer, not just a particular process. When processes exchange data with remote servers, you may want to know what data they actually send and receive.

Wireshark capture localhost traffic