Skip to content
← Documentation

Connection Monitoring

Connection Monitoring

CyberWall provides real-time connection monitoring with a detailed log viewer and network speed tracking.

Connection Log

What Is Logged

Every blocked or allowed connection is recorded:

  • Timestamp
  • Application name and path
  • Protocol (TCP/UDP)
  • Remote IP address and port
  • Direction (inbound/outbound)
  • Action taken (allowed/blocked)
  • Process ID (PID)

Viewing the Log

Open the log viewer from:

  • Main window → Log button
  • System tray → View Log
  • Settings → Connection Log

Log Features

Feature Description
Real-time updates New events appear instantly
Filtering Filter by app, IP, port, protocol
Search Full-text search across all fields
Export Export log to CSV
Clear Clear all log entries

Filtering

Filter the log by:

Filter Description
Application Show only specific apps
IP address Filter by remote IP
Port Filter by remote port
Protocol TCP or UDP
Direction Inbound or outbound
Verdict Allowed or blocked

Network Speed Monitoring

Live Display

The sidebar shows real-time network speeds:

  • Download — Incoming traffic speed
  • Upload — Outgoing traffic speed
  • Session total — Total data this session

Display Modes

Mode Description
FluidStream Animated wave visualization
Bars Bar chart animation
None Numbers only

Speed Format

  • Auto-scaling units (KB/s, MB/s, GB/s)
  • Updates every second
  • Peak speed indicator

Connectivity Monitoring

Internet Status

CyberWall monitors internet connectivity:

  • Connected — Internet is available
  • Lost — Internet connection lost
  • Restored — Connection re-established

Notifications

Toast alerts for connectivity events:

  • Internet connection lost
  • Internet connection restored
  • Protection status changed

Use Case

  • Detect network outages
  • Monitor VPN connections
  • Track connection stability

Application Info Monitor

Version Change Detection

CyberWall detects when applications are updated:

  • Monitors executable version info
  • Alerts when an allowed app changes
  • Prevents unauthorized updates from having access

Monitor Features

Feature Description
Version tracking Records app version changes
Path monitoring Detects executable relocation
Signature check Verifies digital signatures
Alerts Toast notification on changes

Why It Matters

If an allowed app is replaced by malware:

  • CyberWall detects the change
  • Re-prompts for network access
  • Prevents unauthorized network activity

GeoIP Lookup

Local GeoIP Database

CyberWall includes a local IP-to-country database:

  • CC0-licensed whois/ASN data
  • No external API calls
  • Cached locally for performance

What You See

For each connection:

  • Country flag
  • Country name
  • (Optional) City-level data

Privacy

  • All lookups are local
  • No data sent to external services
  • Database stored in %ProgramData%\CyberWall\geo\

Log Storage

Log File

Connection logs are stored in:

%ProgramData%\CyberWall\blocked.log

Rotation

  • Automatic log rotation
  • Configurable maximum size
  • Old entries purged automatically

Log Format

Plain text format:

  • Human-readable timestamps
  • Tab-separated fields
  • Compatible with text editors