Your first week
A day-by-day way to go from “everything is noise” to a rule set that reflects your actual machine.
On day one a network monitor shows you a hundred things you've never thought about, and almost all of them are fine. The goal of the first week isn't to block things. It's to learn what normal looks like on your machine, so that later, when something isn't normal, you notice immediately.
Day 1 — watch, change nothing
Install, let it run, and use the machine exactly as you normally would. Open the Live tab now and then and expand a few processes. You're building an intuition, not a rule set.
Things that surprise almost everyone, and are all normal:
- Dozens of connections from one browser. A single page can be 20 connections to a dozen hosts.
- Programs you aren't using talking anyway. Updaters, sync clients, and license checks all run in the background.
- Windows itself is chatty. Update, time sync, certificate revocation, telemetry — a lot of
svchost.exe. - Traffic to countries you've never visited. CDNs serve from wherever is closest to the edge, not to you.
Day 2–3 — put names to things
Now go the other way: pick the busiest rows and work out what they are. Use theDomains view rather than Apps — it collapses “which 12 IPs is this” into one recognizable name.
Grouping by domain turns “what are all these addresses” into a list of names you can actually judge.
For anything you can't identify, search the executable name along with “what is.” It's almost always a component of something you installed on purpose.
Day 4–5 — turn on approval mode
Now that background noise is familiar, switch on approval mode so you're asked the first time an unfamiliar program reaches out. This is the week's real work: each prompt is a decision you make once.
- Allow permanently for things you recognize and want working.
- Allow once when you're unsure — you'll be asked again, which is a second chance to look it up.
- Block when you don't recognize it and nothing you're doing needs it.
Day 6–7 — tidy up and decide how to run
Two decisions to close out the week:
- Review the Rules tab. Remove anything you allowed hastily. Rules are cheap to delete now and confusing to find in three months.
- Choose your steady state. Most people turn approval mode off and run on Balanced, having answered the prompts that matter. Leave it on if you like being asked.
If you want coverage while signed out, this is also the moment to install the background service — see How NetSecWall works.
Still stuck? Open a support ticket — we reply within one business day.