What are Tun and Tap (ether tap stack) in the startup items folder? Are they legitimate ones used by services like Parallels or HPTrap monitor etc or are they installed to bypass services like Little Snitch? I found them while looking at space hogs on my computer.
TUN and TAP are software-based network devices. They're usually created by VPN or ssh-tunnelling applications to handle network address translation or bridge functions from one network to another. They're also used for virtual machine bridging and you'll find them created by VirtualBox if you happen to use it as a VM solution. Possibly Parallels or Fusion might create them as well (though I don't have them on my Fusion-enabled machines).
If LittleSnitch resides between your ethernet interface and the OS, a TUN/TAP pair won't help route traffic around it. Though it may encrypt it beyond inspection.
That wikipedia lists a bunch of legitimate applications that might set up TUN/TAP pairs on your machine but that list by no means exhaustive. The pair might even be present for Little Snitch packet routing and inspection (though, truthfully, I thought Little Snitch just enhanced OS X's default Firewall service, not replaced it...I may be wrong about that though).
You can use
If that doesn't work you can use Wireshark to listen on the interface(s) for traffic and see if you can figure out from where and to where it's headed. There's a homebrew recipe for Wireshark to install it:
It's a fairly complicated program to use so leave a comment if you need this expanded upon.