Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone know of a free and effective port monitor for mac? Also, can a laymen, in relatively short order, learn to use such software to detect and thus prevent unauthorized remote access/control of their system?

share|improve this question
up vote 3 down vote accepted

Littlesnitch is well worth a look. It's not free however there is a 3 hour use limit at which point you need to restart the filter.

There is also a Lite version of GlowWorm but only supports Tiger.

Or HenWen, an OSX GUI for Snort.

I would pay for Littlesnitch if it were me, $30 US.

share|improve this answer
cool, thanks. – Matt Munson May 6 '11 at 5:39
+1 for Little Snitch – Marc Wickenden May 6 '11 at 14:10

One problem with apps like Little Snitch (which is really designed to detect apps "phoning home") is the amount of hand-holding they need. Even if you assume some basic permissions (web browsers usually end up accessing everything, mail clients need to connect to your mail server, iTunes needs to talk to the music store and so on), you'll still find it prompts you with pop-ups every so often. Whoops, you forgot to allow iChat? That needs to connect to AOL's servers. You need to download the HTML content in that email? A few more web servers to add to Mail's allowance. How many of your apps check RSS feeds for updates? And so on.

All this means that you get annoyed by the dialog during normal operation, making deviations hard to detect. I'm not saying the software has no utility, but that the affordance for a layman to "learn to use such software to detect and thus prevent unauthorized remote access/control of their system" is at best questionable.

share|improve this answer
I just downloaded it and have been using it for a few hours and couldn't agree more with your comments. I think it's good to test against an exploit if you know what calls you are looking for, but to leave it open eternally, consuming resources, to see if there is ever a call to an "suspicious service" is something that I am not finding very effective as a general security strategy. – amateur barista Jan 17 '12 at 0:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.