Connection Inspector

The Connection Inspector is shown in the sidebar of the Network Monitor window. It can be opened in one of the following ways:

Click the sidebar button in the toolbar of the Network Monitor window.
Double-click a connection in the connection list.
Choose View > Show Inspector from the menu bar.
Press the Command-I keyboard shortcut.

Summary view

If there’s nothing selected in the connection list, the inspector shows a summary over all connections that are currently visible in the connection list.

summary-view

Summary — Counts of unique processes and domain names found.
Summarized data volume — Total amount of data sent and received. When you click into the field, the display toggles between total amounts and current data rates.
Connection categories — Counts of connections covered by a Deny-rule (denied), connections that had activity during Silent Mode which has not yet been confirmed and connections initiated by a remote computer (incoming). Click any of the lines to filter by denied, unconfirmed or incoming connections.
Rankings — This section contains top-ranking statistics: The process with greatest amount of data transferred, domains with greatest amount of data transferred and countries with the greatest amount of connections are shown.

Detail view

If one or more connections are selected in the connection list, the details of those connections are shown in the inspector:

detail-view

Data volume — Total amount of data sent and received within the displayed time period. When you click into the line, the display toggles between total amounts and current data rates.
Process information — File system path of the process and name of the process owner. The owner is the user who started the process.
Research Assistant — The Research Assistant may provide more information about the purpose of the connection.
Code Signature — This section shows whether the application or executable on disk has a valid code signature and who signed it.
Connection Details — Shows information about the remote endpoint of the connection and statistics information. The following information is available:
- Summary over — Time interval from the first recorded connection until present, unless a differing displayed time period has been set. Connect counts, data volume and other statistics are collected over this time interval.
- Hostname — Hostname used to establish the connection. Click on a hostname to filter by this particular host.
- IP Address — IP address obtained for the hostname and used for the actual connection. Click on an IP address to filter by that particular address.
- TCP and UDP Port — TCP and UDP ports connected to. Click a port number to filter by that particular port and protocol.
- Protocol — Protocol used for the connection. Click on a protocol to filter by that particular protocol.
- Connects — How often the connection has been established (for connection based protocols) and how often an attempt has been denied.
- Last Allowed — When the connection has been allowed last.
- Last Denied — When the connection has been denied last.
Geographic Information — City, state, country and continent information for the remote endpoint of the connection. If multiple locations are involved, only the parts common to all of them are shown. You can click any entity to filter by it.

Ports, protocols and Internet addresses — The connection list is hierarchical, but only down to server names. Information on Internet address, protocol and port level are still stored, though. If you want to see statistics or a Traffic Diagram for a particular port, protocol or IP address, just filter by it.

Absolute dates — Dates are often given as relative times (e.g. 25 minutes ago) or in ISO format. Hold the Option-key to show them as absolute dates in your preferred localized format instead.