Live monitoring
Reading the connection tree, expanding a process into its connections, and the IP / domain / country / category views.
The Live tab is the one you'll spend most of your time in. It's a tree: each top-level row is a running program, and expanding it reveals the individual connections that program currently has open. Almost every question — “what is this thing talking to?” or “why is my upload saturated?” — is answered by expanding one row.
Reading a row
A process row aggregates; the child rows are the real connections, with address, port, socket state, and the resolved hostname.
- Process / Connection — the program, then each open connection beneath it.
- PID / State — the process ID on a parent row; the socket state (
ESTABLISHED,TIME_WAIT…) on a child. - Service — for
svchost.exeand friends, which Windows service is actually responsible. This is the difference between “svchost is doing something” and “the DNS client is doing something.” - Rate / Total / Peak — split into download and upload. Peak is the highest rate seen for that row since it appeared, which is what catches a burst you weren't watching.
- Remote host — the resolved name where one is known, with a country tag. A raw IP here means the name couldn't be resolved, which is itself worth noticing.
svchost.exe row looks busy, expand it and read the Service column before drawing conclusions — you're almost always looking at Windows Update, the DNS client, or telemetry, not at anything unusual.The four other views
The View control at the top right regroups the same live data around a different question. The columns change with it; so does what a child row means.
| View | Top-level rows | Answers |
|---|---|---|
| Apps | Processes | What is this program doing? |
| IPs | Remote addresses, with the apps talking to each as children | Who is talking to this address? Useful when one IP appears under several programs. |
| Domains | Hostnames | How much traffic is this service getting, across every app on the machine? |
| Countries | Destination country | Is anything going somewhere I did not expect? |
| Categories | Content category | What kind of sites is this machine reaching — the same grouping the content filter uses. |
Grouped views add columns the process tree has no room for: the Network / CDN owner (from ASN data), the number of distinct ports, and how many apps and connections make up the group. A single IP with one connection and one port is ordinary; one IP with 20 ports across three programs is worth a look.
The graph and the time window
The chart above the tree is total throughput, down and up, over the window you pick (2 minutes by default). It's there for shape, not precision — a flat line with one spike tells you when to look, and the tree tells you at what.
History, and why live is not enough
The Live tab only knows about connections that are currently open. Something that connected for two seconds at 3 a.m. is gone from it. That's what the History tab is for. It holds the same data, persisted to the local database, searchable by app, address, domain, or time range, and it expands to show connections the same way.
If you're investigating something that already happened, start in History. If you're watching something happen now, stay in Live.
Still stuck? Open a support ticket — we reply within one business day.