Focus mode and temporary rules

The Control Center shows the network traffic of the last five minutes at a glance. Two features help you act on what you see there. Focus mode shows which processes caused a particular part of the traffic. With temporary rules, you can quickly deny a process or allow a denied connection for five minutes, without a permanent change to your rules.

Focus mode

When you notice a peak in the traffic chart, focus mode tells you what caused it. It places a frame on the chart, and the list below the chart shows only the processes with traffic in that time interval.

Move the pointer over the focus icon at the top right of the traffic chart. A frame appears on the chart.
Move the frame over the part of the chart that interests you. The list shows the processes with traffic in that interval.
To analyze the interval in detail, click it. Network Monitor opens with a time filter for that interval.

The frame is 30 seconds wide. Modifier keys give you a shortcut and a wider frame: hold them down while you move the pointer over the chart, and the frame appears right away, without the focus icon. The keys decide how wide it is:

Command key: 30 seconds, as with the focus icon.
Option key: 50 seconds.
Option key and Command key: the full five minutes.

The figures in the traffic chart

The figures inside the traffic chart show traffic volumes, not rates. While you point at the chart, they show the volume of the bars under the pointer. Otherwise, they show the total volume of the last five minutes.

The Control Center can also show the current traffic rates above the chart. The setting Show traffic rates above chart in the Control Center settings decides when it does.

Temporary rules

The Control Center lets you quickly deny a process or allow a denied connection for five minutes. This way, you can react right away to what you see, before you make a permanent decision:

Deny a process to stop suspicious traffic: The list shows a process that sends or receives megabytes of data, and you don’t know why. Click the process and choose Deny for 5 Minutes. This creates a temporary rule that denies all connections of the process and gives you time to find out what’s going on. If you don’t want this traffic, turn the temporary rule into a permanent rule in the Rules window.
Allow a denied connection to solve a connection problem: An app or a website doesn’t work correctly, and you find its connection in the Recently Denied list. Click the connection and choose Allow for 5 Minutes. This creates a temporary rule that allows only this connection. If it solves the problem, turn it into a permanent rule in the Rules window. If it doesn’t, click the connection again and choose Cancel Timer.

While the temporary rule is active, a badge next to the entry counts down the remaining time. A red badge means denied, and a green badge means allowed.

When the time is up, the temporary rule ends, and your other rules apply again. To end it earlier, click the entry and choose Cancel Timer.