Since right now the main purpose for you in using LS is you are looking for anything like .rserv wants to connect to badsitelskiknskgba.com (I made that up), if you see something like that just Deny. Little Snitch is based on Application and Process requests for outgoing connections. A lot of stuff, mostly legitimate, is usually going on behind your back. With LS you get to see what that is.
Here's an except from a thread in a another forum where we were introducing Little Snitch to someone. (I could give you a screenshot of my ruleset, but I've modified the default one so much it would just be confusing.)
In general, unless it's fairly obvious where it's coming from and it's needed, just deny first -- from experience, you develop a sense about when it sounds legitimate. Then, if something's broken, google the url in question, check with WOT (WOT, Web of Trust, can be added to a number of browsers) and if it looks OK, then go back and allow. Very often, if you deny, nothing gets broken and there's no reason to do any research, except out of curiosity. Often, I'll google first before deciding whether to allow or deny, and leave the pop-up hanging until I decide. When you are being prompted to allow or deny, you can "Show Details" to get more information....
...Just to add, if an application has no reason to be communicating out over the internet, like say TextEdit, which simply edits files on your local system and literally is incapable of opening documents residing on a server someplace on the internet, there's no reason to allow it to communicate to a server on the internet. If it's a program like Firefox, which needs to talk to web servers (port 80 and 443), then you allow that communication to happen. If it's an FTP (File Transfer Protocol) program, which needs to talk to an internet server over FTP in order for you to transfer files off that server onto your system, then you allow it to communicate over port... er... 21? 23? If it's a "free" game that doesn't support network play that for some mysterious reason is trying to talk to an IP address that doesn't resolve to a hostname, then you block it.
For most part it just requires you to sit back and think about things logically in that fashion, it's only when you get into cryptic stuff like destroying the App Store that it becomes mildly counter-intuitive and cryptic.
And the prompts on Little Snitch are somewhat informative, in that they always do a reverse DNS lookup, which (normally) changes an unintuitive IP address into a fully qualified server name (http://www.apple.com instead of 23.1.61.15), which makes it lot easier to figure out what's talking to where.
After a few days of firing up all your normal apps Little Snitch will literally be transparent, only prompting you when you add something new to your system....
When Firefox goes to http://www.google.com/ it talks to http://www.google.com on port 80. Google then sends back information to your system so that you get the web page. When Firefox tries to make that initial connection to http://www.google.com, Little Snitch will pop up a warning telling you that Firefox is trying to communicate with http://www.google.com over port 80. Since you typically want to browse the web with a web browser, I typically choose the "allow port 80 communication with any server" option, instead of just allowing port 80 traffic with http://www.google.com, because allowing connections to each server would get tedious fast, as every web site would result in a new popup. I don't mind if Firefox communicates with a web server over port 80 - that's it's intended purpose.
The same process occurs with Firefox and port 443 (https) connections. Firefox tries to connect to http://www.google.com on port 443, which causes Little Snitch to pop up a warning letting you know a network connection attempt is being made, and you allow Firefox to communicate to any web server over port 443.
Understand that Little Snitch remembers and manages connection attempts on an application, not system, level. If you fire up Safari and try to talk to a web site, it's going to pop up the same kind of connection messages because it's not Firefox. So basically each application gets it's own set of connection filters that you choose to either allow or deny.
Typically malware will attempt to connect to systems over nonstandard ports, like IRC, so after allowing port 80 & 443 if Firefox suddenly wants to talk to an IRC server you know something strange is going on.
http://x704.net/bbs/viewtopic.php?f=12&t=5622&start=25
And here's something that might also be a bit helpful.
http://www.techrepublic.com/blog/mac/protect-your-privacy-with-little-snitch-for -mac/448
