Search and filters

The search field performs a textual substring search in all items of the connection list. By default, it searches in process names and server names. You can enter multiple search terms by pressing Enter after each term. Only items matching all search terms are shown.

Once you pressed Enter, the search terms turns into a blue token. Each token has a menu where you can choose the search scope. In this way you can limit a textual search to domains or apps only or choose to search in IP addresses, protocols or geographic information.

Search term — Enter any text in order to search for it in the connection list.
Scope — Select the scope where to search for the text.
Clear search — Click here to clear all search terms but not filters.
Direction filters — Click this button to filter on incoming connections only. Click and hold for more options. Remove the filter with a single short click.
Rule filters — Click this button to filter on connections denied by your current rule set only. Click and hold for more options. Remove the filter with a single short click.
Time filters — Click for a menu of time based filter options.

If you want to see what new connections occur as a consequence of an action, choose the time filter From Now (keyboard shortcut Command-K). Immediately after setting this option, the connection list is empty and connections appear as they occur. Perform the action in question (e.g. load a web page) and see in realtime how connections are made.

Local network connections

One option which is technically a filter can be found in the view options: whether to show or hide local network connections. Connections to devices in your home or office, e.g. your printer, scanner, network attached storage, router etc. are only shown when this option is on.