Connection monitoring

Inspect individual network flows without confusing them with SSH sessions or connected devices.

Open the right view

In Overview, click Transparent Proxy Connections to open the rules page’s active-flow table. It combines monitored transparent-proxy and network-sharing flows. Click Network Sharing Connections for the separate shared-connection details window. Active Connections in Overview instead lists SSH profiles.

Read and filter rows

Search the flow table by application, destination, rule, proxy or source. Check source identity, protocol, target and matched route together; a connection count is not a device count. Shared details include start time, state, source mode/IP, username, target, protocol, rule/proxy and download/upload. Click column headers to sort and drag column edges to resize.

Disconnect and interpret persistence

Where available, the active-flow context menu can end a selected connected flow. It does not delete a rule or disconnect the whole SSH profile. The shared-details window is an inspection table, not a separate set of disconnect controls. Apps can reconnect immediately. Closing a phone app or Wi-Fi may not send a final close; TCP must detect loss, and UDP has no connection-close handshake. A lingering row alone does not prove continued traffic.

Understand the limits

Shared details show up to 500 active flows; pending handshakes may not yet appear and UDP may create multiple rows per shared connection. The footer counts displayed rows, not all devices or historical sessions. These views are not a complete record of all Mac traffic, particularly connections handed back to the system for DIRECT routing. Use logs and timestamps to investigate; do not infer an exact phone-app shutdown time.

Logs and diagnostics · Routing rules and traffic sources · Share proxy routing with LAN devices