How NetSecWall works
What the app actually watches, how it sees per-app traffic, and the two engines it can block with.
NetSecWall does two separate jobs, and it's worth keeping them apart because they fail in different ways. It watches every network connection your PC makes and attributes each one to the program that made it. Separately, and only when you tell it to, it blockstraffic. Watching is passive and safe. Blocking changes how your machine behaves.
How it sees per-app traffic
Windows already knows which process owns which socket. The difficulty is getting at that continuously without slowing the machine down. NetSecWall subscribes to ETW (Event Tracing for Windows), the same kernel instrumentation Microsoft's own tools use, and pairs each connection event with the process that opened it. It also polls the socket table to catch anything that was already open when the app started.
Two consequences follow from that design, and both matter:
- It sits beside your traffic, not in the middle of it. Nothing is proxied, decrypted, or rerouted. Monitoring cannot corrupt a download or add latency to a call, because your packets never pass through NetSecWall.
- It needs administrator rights. Per-process network attribution and firewall rule changes are both privileged operations in Windows. An app running as a normal user cannot see them. That's why NetSecWall asks for elevation every time.
The two blocking engines
When you block something, NetSecWall can enforce it two ways. Which one you want depends on what else is managing your machine.
| Engine | How it blocks | Choose it when |
|---|---|---|
| Windows Firewall | Writes rules into the Windows Firewall that ships with the OS. Visible in wf.msc alongside every other rule on the machine. | The default. Nothing else is managing your firewall rules, and you want blocks that survive even if NetSecWall isn't running. |
| Packet filter (WFP) | Installs filters through the Windows Filtering Platform, the layer the OS firewall is itself built on. Finer-grained, and it doesn't touch your rule list. | Another tool already owns your Windows Firewall rules, or you want per-connection control the rule engine cannot express. |
There's also Companion mode, for machines where a third-party suite already manages the firewall. NetSecWall keeps monitoring and can still block using its own engine, without touching the other tool's rules, so the two never fight over the same configuration.
What runs, and when
Closing the window minimizes to the tray and keeps monitoring. For coverage that starts before you sign in — and continues while you're signed out — the setup wizard can install an optional background service. Without it, monitoring only runs while the app does.
The status bar always says which engine is enforcing and whether anything is currently flagged.
Where your data lives
All of it stays on the PC, in a local database. Connection history, rules, detections, and settings are never uploaded. The app contacts our servers for exactly three things: to validate a license, to fetch threat-intelligence lists, and to check for updates. Anonymous usage analytics exist, but they're strictly opt-in and you can decline them without any effect on features or price — see the privacy policy.
Still stuck? Open a support ticket — we reply within one business day.