Objective Development Forums

Let me first respond to the alert loop: This happens if Little Snitch cannot determine the host name for the remote computer uniquely. If there are multiple names and applying rules to all these names does not yield the same result (allow or deny), Little Snitch shows an alert for the IP address.

Not there are two questions: (1) Why has it not been able to determine the host name from TLS SNI headers? And (2) when you create an IP address based rule, why does it not match?

The answer to (1) may be a behavior of Chrome, maybe it does not send any headers when it knows that the network is down. This is something we would have to investigate. I don't have a good answer for (2), though. The rule you created may have lower precedence than other rules which are not unique. This could result in the type of alert loop you described.

We have done some improvements in 4.1 in this respect. If no unique rule can be determined and the set of matching rules have contradicting actions, we now show the alert. The current 4.1.3 nightly logs these events into the LS Daemon log, if you want to analyze this further.

Regarding memory usage: If this happens during sleep or screen locker, it's very likely related to this other issue where Little Snitch Agent hangs in a graphics library call every two minutes. I suspect a graphics driver problem on your machine.

We better go back to the Agent hang problem because it occurs more frequently and should therefore be easier to watch. This may even be a bug in Apple's drivers with no easy way for us to fix it. Do you experience hangs in other apps, especially after wake from sleep?

Do you experience hangs in other apps, especially after wake from sleep?

Chrome hangs while LSNM has it trapped in an alert loop, but nothing else has a noticeable delay when waking from sleep.

I think we have identified the cause for the alert loops and will fix it in one of the upcoming nightly releases.

But the other issue, the hang in the graphics driver and the lost memory blocks -- no idea. Sorry. I'm just running out of ideas...

But the other issue, the hang in the graphics driver and the lost memory blocks -- no idea. Sorry. I'm just running out of ideas...

In desperation, I turned off LSNM's Network Filter: menu > Stop Network Filter.

... and LSNM has grown to 923MB anyway.

Does that usefully narrow the search scope?

Network Monitor is independent of the filter. The network filter is installed in the kernel and filters all data packets sent or received according to your rules. Network Monitor, on the other hand, receives connection data and visualizes it.

If you want to work without Network Monitor, turn it off in Little Snitch Configuration > Preferences > Monitor. You can still get alerts, manage rules etc without Network Monitor.

Network Monitor is independent of the filter. The network filter is installed in the kernel and filters all data packets sent or received according to your rules. Network Monitor, on the other hand, receives connection data and visualizes it.

If you want to work without Network Monitor, turn it off in Little Snitch Configuration > Preferences > Monitor. You can still get alerts, manage rules etc without Network Monitor.

Gotcha. Turning the filter back on puts me back in the chrome alert loop, so I'm leaving that off for now. Turning off the monitor as well terminates the LSNM process, which stops the memory growth. Looks like I've turned off LS entirely(?) at this point.

Yes.

Regarding the Network Monitor memory consumption issue: The "lost memory" should not affect your system, in theory, because the memory is never used and can be swapped out completely. I know that this is not 100% true in practice and the effort of administering swap space costs a bit of performance. But you could turn off and back on Network Monitor once in a while. When it quits, the memory is freed.

Regarding the alert loop: That's pretty interesting because it obviously depends on the link status of your provider. Please keep up-to-date with our nightly builds. The current nightly has a debug log (in /Library/Logs/LittleSnitchDaemon.log) which (hopefully) explains why the alert loop occurs. If you install this, please let us know what it prints when the loop occurs. The next nightly will hopefully have a kind-of fix or workaround. At least you should have a way to escape the loop.