Connection Inspector

The Connection Inspector is shown in the sidebar of the Network Monitor window. It can be opened in one of the following ways:

Click the sidebar button in the toolbar of the Network Monitor window.
Choose View > Show Inspector from the menu bar.
Press the Command-I keyboard shortcut.

Summary view

If there’s nothing selected in the connection list, the inspector shows a summary over all connections that are currently visible in the list.

Summary inspector

Summary — Counts of unique processes and domain names found.
Summary of data volume or data rate — Total amount of data sent and received or current data rate. Click into the field to toggles between total amount and current data rate.
Statistics by property — Counts of connections at the domain level which are
- covered by a Deny-rule (denied),
- had activity during Silent Mode and no rule was created yet
- and connections initiated by a remote computer (incoming).
  Click any of the lines to filter by denied, unconfirmed or incoming connections.
Rankings — This section contains top-ranking statistics: The process with greatest amount of data transferred, domains with greatest amount of data transferred and countries with the greatest amount of connections are shown.

Detail view

If one or more connections are selected in the connection list, the details of those connections are shown in the inspector:

detail-view

Data volume — Total amount of data sent and received within the displayed time period. When you click into the line, the display toggles between total amounts and current data rates.
Reveal process in Finder — Click here to open the path shown in Finder. If a process uses a helper process to connect, you can choose which path to open from a menu.
Process information — File system path and code ID of the process and name of the process owner. The owner is the user who started the process.
Internet Access Policy — The Internet Access Policy, if available, provides more information about the purpose of the connection.
Code Signature — This section shows whether the application or executable on disk has a valid code signature and who signed it. The check performed here covers the entire app bundle including all resources and it may take a while for large bundles such as Xcode.
Connection Details — Shows information about the remote endpoint of the connection and statistics information. The following information is available:
- Summary over — Time interval from the first recorded connection until present, unless a differing displayed time period has been set. Connect counts, data volume and other statistics are taken over this time interval.
- Hostname — Hostname used to establish the connection. Click on a hostname to filter by this particular host.
- IP Addresses — IP addresses obtained for the hostname and used for the actual connection. Click on an IP address to filter by that particular address.
- TCP and UDP Port — TCP and UDP ports connected to. Click a port number to filter by that particular port and protocol.
- Protocol — Protocol used for the connection. Click on a protocol to filter by that particular protocol.
- Connects — How often the connection has been established (for connection based protocols) and how many connection attempts were denied.
- Last Allowed — When the connection has been allowed last.
- Last Denied — When the connection has been denied last.
Server location — Information from IP address database: City, state, country and continent information and address range owner for the remote endpoint of the connection, as far as available. If multiple locations are involved, only the parts common to all of them are shown. You can click any entity to filter by it.

Absolute dates — Dates are often given as relative times (e.g. 25 minutes ago) or in ISO format. Hold the Option-key to show them as absolute dates in your preferred localized format instead.