Start here

History, search, and reports

Investigating something that already happened: time ranges, per-app history, the DNS log, and what the reports contain.

6 min read · updated July 25, 2026

The Live tab only knows what is open right now. Something that connected for two seconds last night is not there. Everything below is for the other question — what happened?

History

NetSecWall writes every connection to a local database as it closes, so History is the same tree you already know, over a time range you choose. Pick the range first, then narrow.

History ▸ last 24 hours, filtered to one app

▾updater.exe142 conns3.1 MB

└203.0.113.44:44302:14, 03:14, 04:14…every 60 min

└cdn.vendor.example:44302:142.9 MB

History is where a repeating pattern becomes obvious — the same address at the same interval, all night.

Widen the window before you narrow the filter. A pattern that's invisible over an hour is unmistakable over a week, and beaconing is a pattern, not an event.

Searching

You can search by any of the things you can see:

Program — everything one executable has ever done.
Address or domain — everything that has talked to one destination, across all programs. This is the one that finds “what else on this machine contacts that?”
Country or category — useful before writing a country or category rule, to see what you'd actually be blocking.
Time range — combine with the above; “this app, this week” is the common shape.

The DNS log

Separately from connections, NetSecWall records the names that were looked up, when, and by which program. That matters because a name is often the only human-readable thing in the whole exchange. An address tells you little; telemetry.vendor.example tells you plenty.

It also catches lookups that never became connections. That's exactly what you see when something is probing for a server that's down, or when a name resolves and a rule then blocks the connection.

If you use encrypted DNS in your browser (DoH), those lookups happen inside an HTTPS connection to the resolver and NetSecWall cannot see the names — you'll see the connection to the resolver instead. That's the browser's design, not a gap in monitoring.

Retention: your disk, your call

History lives on your PC and nowhere else. It's metadata rather than contents, so it stays small. It does grow, though, and the retention window is a setting. Shorten it if space matters; lengthen it if you like being able to answer questions about last month.

Reducing retention deletes older history immediately, and there is no undo. If you're investigating something, export or note what you need before you trim the window.

Reports

Reports roll a period up into something readable in one pass: which programs moved the most data, which destinations came up most, what was blocked, and what was flagged. They're the right tool for a weekly skim — you're looking for the row that surprises you, not for detail.

Every report is derived from the same local database, so it can never show more than your retention window holds.

Investigating something specific? Start in History with a wide time range and thedestination as the filter, not the program. If more than one program is talking to the same unexplained address, that's far more informative than anything a single app's history will tell you.

Still stuck? Open a support ticket — we reply within one business day.