Three-way handshake bypassing Little Snitch
There has been some discussion recently about the bypassing of Little Snitch by the first datagram of a three-way TCP handshake. The facts: When a deny-rule for a domain is set in Little Snitch, and a TCP connection is made to that domain, a TCP SYN data packet is sent to the remote server. Although this packet does not carry any payload, it does include crucial information such as your IP address, as well as the sending and receiving port numbers.