Monitor App Connections

You Are a Hose Spewing Data

Not gross at all.

Every app you install assumes it has unlimited outbound network access.

Your Computer Talks. A Lot. Without Asking.

  • Every app you install phones home by default
    • Telemetry, usage stats, update checks, license pings — none of it disclosed clearly
  • Your OS is the worst offender of all
    • Windows 11 calls Microsoft telemetry endpoints even on a fresh install with no apps
    • macOS has a dozen background daemons making network calls you never see
    • Ubuntu phones Canonical with package popularity data by default
  • The firewall that shipped with your OS doesn't help
    • Windows Defender Firewall: blocks inbound by default, outbound is wide open
    • macOS Application Firewall: inbound only — same story
    • Linux iptables/nftables: powerful, but not per-app without extra configuration
  • App update services run 24/7 even when the app is closed
    • Google Update, Microsoft AutoUpdate, Adobe ARM — always running, always checking
    • Many spawn separate helper processes that never appear in your task manager
  • Electron apps are particularly bad
    • Slack, VS Code, Discord, Notion — each ships its own Chromium and phones home on launch
    • You can't see which part of the app is making which call without a process-level firewall
  • What you need is an application-layer outbound firewall
    • Intercepts connections per process, asks you to allow or deny, logs everything
    • Shows you what's connecting, to where, on which port, and how often
  • This talk covers one tool per platform — free where possible
    • Android: TrackerControl · Windows: WFC · Linux: OpenSnitch · macOS: Little Snitch / Radio Silence

One Tool Per Platform

Platform Tool Cost Mechanism
Android TrackerControl Free / F-Droid Local VPN intercepts all DNS + connections
Windows Windows Firewall Control Free (BiniSoft) GUI + outbound rules over Windows Filtering Platform
Linux OpenSnitch Free / open source Daemon intercepts via netfilter/nfqueue, prompts per process
macOS Little Snitch ~$45 one-time Kernel extension, intercepts all outbound before it leaves
macOS alt Radio Silence ~$9 one-time No-prompt block list — add apps to silence, done
macOS free LuLu Free / open source objective-see.com — same model as Little Snitch, no cost
All platforms Pi-hole / NextDNS Free / freemium DNS-level blocking — catches domains, not process-specific

Same goal across all platforms: see what's connecting and cut off what shouldn't be.

Android — TrackerControl

What It Shows You

  • Local VPN intercepts every DNS query and outbound connection — no root, no server needed
  • Live log tagged by app: which process called which domain, right now, in real time
  • Tracker library cross-reference: shows which SDKs are embedded via Exodus Privacy database
  • Sort by tracker count — the apps at the top of that list will change your opinion of free software
  • Connection counts per app accumulate — background activity during doze mode is visible
  • Export logs or PCAP for Wireshark analysis on your desktop, with zero root required

Setup and Workflow

  • F-Droid → search TrackerControl → install the fdroid variant (Play Store build is restricted)
  • Enable the VPN when prompted — it runs entirely on-device, nothing leaves to a server
  • Use your apps normally for 30 minutes, then sort the live log by tracker count
  • Per-app blocking: allow the app's own servers, block only the embedded tracker SDK domains
  • Block an entire app from the network entirely with one toggle if needed
  • First finding: free games and utility apps routinely make 20–40 tracker calls per session
  • Second finding: apps you haven't opened in days connect in the background during doze

Windows — Windows Firewall Control

What It Is and Why

  • Frontend for the Windows Filtering Platform — the same engine underneath Windows Defender Firewall
  • Adds the outbound connection prompting that Windows never exposed in its built-in UI
  • Made by BiniSoft, acquired by Malwarebytes — still free, no account required
  • System tray icon, notification popups, connection log, rule editor — everything the built-in UI hides
  • Does not replace Windows Firewall: it controls it, so no third-party kernel driver needed
  • Security profiles: High (block all unallowed), Medium (prompt on new), Low (allow most), Off

Recommended Workflow

  • Install WFC, set to Medium filtering — existing Windows rules stay, new outbound gets prompted
  • Use your computer normally for 1–2 days, responding to each popup as it appears
  • Allow: your browser, email client, work apps, OS update endpoints (you want patches)
  • Deny: telemetry endpoints, update services for apps you update manually, background agents
  • After your allow-list is built out, switch to High filtering — default-deny for new connections
  • What you'll catch: Adobe checking license servers every session, every Electron app on launch, game launchers

Linux — OpenSnitch

How It Works

  • Application-level outbound firewall inspired by Little Snitch — same prompt-on-new-connection model
  • opensnitchd daemon sits in the network stack via netfilter/nfqueue — intercepts every new connection
  • New outbound from any process → popup appears with: process name, PID, destination, port
  • You allow or deny, with scope: this session only / permanent / by port / by destination IP
  • Rules stored as JSON in /etc/opensnitchd/rules/ — shareable, exportable, version-controllable
  • GUI frontend shows live connection table, process tree, rules, statistics

Install and What You'll Find

  • Packages for Debian/Ubuntu, Fedora, Arch (AUR) — or build from github.com/evilsocket/opensnitch
  • Start daemon: sudo systemctl enable --now opensnitchd — GUI launches from app menu
  • Rule granularity: allow/deny by process path, destination hostname, destination IP, port, or user
  • Fresh Linux install findings: packagekitd checking repos constantly, Flatpak phoning its store
  • GNOME and KDE desktop components sending usage telemetry — you'll be surprised what's in there
  • Your browser's update service runs as a separate process from the browser itself

macOS — Little Snitch and Radio Silence

Little Snitch — The Full Solution (~$45)

  • Intercepts every outbound connection before it leaves — kernel extension, nothing escapes
  • Alert on new connection: "App X wants to connect to hostname on port Y — allow or deny?"
  • Network Monitor — live map of all active connections with real-time data rates
  • Profiles — different rule sets for home, work, travel — auto-switches on WiFi network change
  • Research Assistant — looks up the owner and purpose of every IP before you decide to allow it
  • What it catches: trustd, rapportd, com.apple.geod

Radio Silence — The Simple Solution (~$9)

  • Different philosophy: no prompts, no rules engine — just a block list
  • Add apps to the block list → they get zero network access, permanently, no exceptions
  • No logging — you can't see what it blocked, but you don't need to if you know what to silence
  • Best candidates: Adobe Creative Cloud helpers, Microsoft AutoUpdate, crash reporters, game launchers
  • Takes 30 seconds to set up — add the apps, close it, done
  • radiosilenceapp.com — the decision framework: if you want to understand, use Little Snitch first

What You Will Actually Find

  • OS telemetry from the vendor you paid for the device
    • Windows 11: vortex.data.microsoft.com, settings-win.data.microsoft.com, watson.telemetry.microsoft.com
    • macOS: xp.apple.com, metrics.apple.com, feedbackws.icloud.com, swscan.apple.com
    • Ubuntu/Canonical: metrics.ubuntu.com, popcon.ubuntu.com — opt-out exists but isn't default
  • Update services running 24/7 for apps you open once a month
    • Google Update, Microsoft AutoUpdate, Adobe ARM — all running even when the app is closed
    • Many add themselves to system startup and run as background services without visible UI
  • License and activation pings on a timer
    • Software checks its license server on launch and periodically — identifiable by vendor-name hostnames
    • Some products phone home every time you open a file, not just on app launch
  • Crash reporters holding device snapshots ready to send
    • Crashlytics, Sentry, Breakpad — stack traces plus device state sitting queued to third-party servers
  • "Analytics" that are behavioral tracking with a polite name
    • Segment, Mixpanel, Amplitude, PostHog — in freemium apps, Electron apps, many open source tools
  • Cloud sync running on a schedule you didn't set
    • Dropbox, OneDrive, iCloud syncing even when you've "paused" them — check the actual network log
  • Background agents for apps you uninstalled months ago
    • Residual helper processes surviving uninstall — LaunchAgents on macOS, Services on Windows

Practical Workflow — Four Phases

Phase 1 — Observe (First 1-2 Days)

  • Install your platform's tool, set to log/prompt but do not block aggressively yet
  • Use your computer exactly as normal — let a full day of activity accumulate
  • Build a picture: what connects, when, to where, on what schedule

Phase 2 — Allow Your Legitimate Traffic

  • Create allow rules: browser, email, work apps, package managers, your actual tools
  • Allow OS update endpoints — you want security patches, block telemetry separately
  • Allow anything you consciously chose and actively use on a regular basis

Phase 3 — Deny the Noise

  • Telemetry and analytics endpoints: deny permanently, no exceptions
  • Update services for apps you update manually or rarely use: deny or allow only on demand
  • Background agents for apps you rarely open: deny until you actively launch the app

Phase 4 — Go Strict

  • Switch to default-deny for all new outbound connections
  • Each new app install generates a prompt — make the allow/deny decision at install time
  • Watch for apps that switch to hardcoded IPs to bypass hostname-based block rules

What These Tools Cannot Catch

  • Traffic inside your browser process
    • The browser is one connection from the OS's view — you can't see which tab or extension
    • Use uBlock Origin + browser DevTools Network tab for in-browser auditing
  • Hardcoded IP addresses that skip DNS entirely
    • Some apps connect straight to an IP — hostname-based rules miss these completely
    • Watch the raw connection log for connections with no associated hostname
  • Encrypted DNS (DoH/DoT) used by the app itself
    • Apps using their own DNS-over-HTTPS bypass your system resolver and your DNS blocklists
    • The connection shows as HTTPS to a Google or Cloudflare IP — easy to miss without IP rules
  • Traffic from VMs, containers, and WSL
    • Docker containers have their own network namespace — OpenSnitch and WFC see the Docker daemon
    • WSL2 on Windows routes through a virtual adapter — per-app rules don't apply inside it
    • Requires per-container rules or a network-layer monitor at the bridge interface
  • Your ISP and carrier layer
    • These tools control what leaves your device — not what your ISP logs after that
    • For ISP-level privacy: DNS-over-HTTPS/TLS to a trusted resolver, plus a VPN
  • Supply chain and compromised app servers
    • If an app's own server is compromised, you've allowed those connections — the firewall helped that traffic through
    • These tools answer "is the app calling home?" not "is the app's home trustworthy?"

Layering These Tools for Maximum Coverage

On the Device

  • Run your platform firewall (WFC / OpenSnitch / Little Snitch) — per-process, per-destination visibility
  • Add a DNS blocker on top: NextDNS or Pi-hole — catches tracker domains before the firewall sees them
  • Use uBlock Origin in your browser — handles the in-browser traffic the firewall can't see
  • Keep a dedicated test device or VM for auditing new apps before allowing them on your main machine

At the Network Level

  • OPNsense with Unbound DNS blocklists: every device filtered, including things you can't install software on
  • ntopng: visibility into everything — smart TVs, IoT, guests, all at once
  • IP blocklists via firewall aliases: hardcoded IPs caught even when DNS blocking fails
  • Guest and IoT VLANs: isolated at the network layer regardless of what's on the device

The Combined Picture

  • Device firewall: shows you which process made which call on your main machines
  • DNS blocklists: catch tracker domains for every device without any per-device config
  • IP blocklists: catch hardcoded IPs and known infrastructure that bypasses DNS
  • Network monitor: shows you what slipped through all of the above
  • No single layer catches everything — each catches what the others miss

Resources

Tool Platform Where
TrackerControl Android F-Droid — search TrackerControl, use fdroid variant
Windows Firewall Control Windows binisoft.org/wfc.php — free
OpenSnitch Linux github.com/evilsocket/opensnitch
Little Snitch macOS obdev.at/products/littlesnitch — ~$45
LuLu macOS objective-see.com/products/lulu.html — free
Radio Silence macOS radiosilenceapp.com — ~$9
Exodus Privacy Android APK scanner exodus-privacy.eu.org
Pi-hole Network-wide DNS pi-hole.net — self-hosted
NextDNS Network-wide DNS nextdns.io — cloud, per-device logs, free tier
WindowsSpyBlocker Windows blocklist github.com/crazy-max/WindowsSpyBlocker
privacytests.org Browser comparison What each browser phones home with
uBlock Origin Browser extension In-browser connection control