See what your computer is connecting to

What you can see

• Live connections: IPv4 and IPv6, TCP and UDP, each with its owning process, image path and Authenticode signature verdict. External established connections owned by unsigned or untrusted executables are flagged as notable.
• DNS visibility: the Windows resolver cache shows which domains this machine has recently resolved, and an administrator-only live ETW watch (winsight dns --watch) streams queries as they happen.
• Per-process drill-down: winsight process <pid> combines one process’s lineage, loaded modules and live connections in a single report.

What the data means, and what it does not

WinSight is precise about the difference between current and historical visibility. Live connections are what the TCP/UDP tables report right now. The DNS cache is historical: it tells you a domain was resolved recently, but cache data does not by itself attribute every query to a specific process, only the live ETW watch (which needs elevation) sees queries with that fidelity.

WinSight does not do packet inspection, does not record traffic volumes or bandwidth graphs, and keeps analysis on the device. If you want per-app bandwidth accounting over time, a tool like GlassWire is a better fit. See the honest comparison.

Data retention

Results are computed on demand and stay local. There is no cloud backend, no account and no telemetry; nothing you see in the connections view leaves your machine.

From seeing to acting

Visibility pairs naturally with control: once you have identified a program you don’t want talking to the network, the outbound firewall can block exactly that application at the kernel filtering layer, audit-first, so you can confirm the policy before it enforces.