Skip to content GitHub
Guide contents
English View source

Connection Monitoring

Connection Monitoring

CyberWall provides real-time connection monitoring with a detailed log viewer and network speed tracking.

Connection Log

What Is Logged

Every blocked or allowed connection is recorded:

  • Timestamp
  • Application path (name resolved in the UI)
  • Remote IP address and port
  • Direction (inbound/outbound)
  • Action taken (allowed/blocked)
  • Process ID (PID)

Viewing the Log

Open the log viewer from:

  • Main window → Connections tab
  • System tray → blocked log entry

Log Features

Feature Description
Real-time updates New events appear instantly
Filtering Text search plus Blocked / Allowed pills
Search Search across app, IP, port, and country
Copy Copy all visible entries to the clipboard
Open file Open the raw log file directly
Clear Clear all log entries

Filtering

Filter the log by:

Filter Description
Text search Match app, IP, port, or country
Verdict All, Blocked, or Allowed

Network Speed Monitoring

Live Display

The sidebar shows real-time network speeds:

  • Download — Incoming traffic speed
  • Upload — Outgoing traffic speed
  • Session total — Total data this session

Display Modes

Mode Description
FluidStream Animated wave visualization
Glow Pulse Subtle pulse animation
Static (Disabled) Numbers only

Speed Format

  • Auto-scaling units (KB/s, MB/s, GB/s)
  • Updates every second
  • Peak speed indicator

Connectivity Monitoring

Internet Status

CyberWall monitors internet connectivity:

  • Connected — Internet is available
  • Lost — Internet connection lost
  • Restored — Connection re-established

Notifications

Toast alerts for connectivity events:

  • Internet connection lost
  • Internet connection restored

Use Case

  • Detect network outages
  • Monitor VPN connections
  • Track connection stability

Application Info Monitor

Version Change Detection

CyberWall watches executables that already have rules and notifies when they change:

  • Monitors executable version info, file size, and write time
  • Adds a notification when an allowed app changes
  • Optionally shows a toast alert
  • Existing rules stay in place; review them manually if something looks wrong

Monitor Features

Feature Description
Version tracking Records app version changes
Binary change detection Detects executable size / write-time changes
Alerts Notification-center entry on changes, plus optional toast

Why It Matters

If an allowed app is replaced or updated:

  • CyberWall records the change as a notification
  • You can review whether the rule should stay

GeoIP Lookup

Local GeoIP Database

CyberWall uses a local IP-to-country database:

  • CC0-licensed whois/ASN data, downloaded then cached locally
  • Country-level data only
  • Cached locally for performance

What You See

For each connection:

  • Country flag
  • Country name

Privacy

  • Lookups are local; destination IPs are not sent to a geo API
  • Downloading the database requires internet access
  • Database stored in %ProgramData%\CyberWall\geo\

Log Storage

Log File

Connection logs are stored in:

%ProgramData%\CyberWall\blocked.log

Rotation

  • Automatic trimming when the file exceeds 4 MB
  • Keeps the most recent entries (last 8000 lines)
  • Not configurable

Log Format

Pipe-separated text format:

  • Human-readable timestamps
  • Pipe-separated fields
  • Compatible with text editors
← All documentation