Process & Port Analyzer

1. Getting Started

The status bar at the bottom shows whether you're running as ● Administrator or ○ User, along with a running count of items on the current tab.

The toolbar (top)

The sidebar (left)

Five summary cards show live totals: Running Processes, Listening Ports, Failed Logins, Firewall Rules, and Flagged for Review — how many processes the risk heuristics have flagged. Click that last one to jump straight to the Processes tab with the Flagged only filter turned on, so you land on just the flagged processes. They update automatically as you use each tab.

Keyboard shortcuts

2. Processes

Lists every running process with its icon, name, process ID (PID), memory use, peak memory, file path, architecture (32- or 64-bit), whether it’s a System or User process, and a Risk flag.

• Use the controls above the list to filter:
  • Hide Protected / Show All — hide or include protected system processes.
  • System / User / 32-bit / 64-bit checkboxes — narrow the list by type.
  • Sort by dropdown — order by any column.
  • Flagged only — show just the processes the risk heuristics flagged.
• Type in the toolbar Search box to filter by name or path.
• Click any column header to sort by that column; click again to reverse.
• Double-click a process to see the modules (DLLs) it has loaded. The Modules window checks each file’s digital signature in the background and adds Signed, Company and Version columns; unsigned files are tinted red, which is worth a look when they’re loaded into an otherwise signed program. Esc closes it.

The Risk column

After the list loads, the app scores each process against a set of local heuristics and flags anything worth a second look as Medium or High. Select a flagged row to see exactly why it was raised in the panel under the list (hovering the flag shows the same) — for example an unsigned binary running from a temporary folder, a program using a Windows system name from the wrong location, or a script host launched by an Office application. Sorting by Risk puts High above Medium.

Signatures are checked the way Windows checks them: a file counts as signed if it carries its own signature, is listed in a Windows security catalog (as most built-in Windows programs are), or was installed from a signed Microsoft Store package.

3. Listening

Shows processes that are listening for incoming connections, with the local address, port, owning process, and protocol (TCP/UDP). Both IPv4 and IPv6 listeners are shown (IPv6 addresses look like ::, ::1 or fe80::…).

• Filter by protocol or use the search box above the list.
• Right-click a row for:
  • Block listening port — opens the firewall dialog pre-filled to block that port, on the address the program is listening on.
  • Block program’s network access… — cuts that program off on every port.
  • Show details.
• Double-click a row to view that process's loaded modules.

4. Connections

Shows all active network connections (TCP and UDP, IPv4 and IPv6): the owning process, local and remote address/port, and the connection state (such as ESTABLISHED, LISTEN or TIME-WAIT). The State filter offers every state.

• Filter by protocol and state, or use the search box.
• Right-click a row → Block connection to create a firewall rule for it. For an outgoing connection this blocks traffic to the remote address and port.
• Right-click → Resolve host name to look up the DNS name of the remote addresses in the selected rows.
• Tick Geo-locate (online) to fill in the Location column with each remote address’s country and city.
• Double-click a row to view that process’s loaded modules.

5. Failed Logins

Lists failed sign-in attempts recorded by Windows (requires Administrator).

Each entry shows the time (in your local time zone), user name, source IP, logon type, whether it was local or remote, and the related process ID. The 100 most recent matching events are shown, and the status bar tells you when that limit has been reached. Loading runs in the background, so the window stays responsive while Windows searches the Security log.

6. Sniffer

Captures live network packets on a chosen network address (requires Administrator).

Scroll up in the log at any time to read back — the view stays where you put it instead of following new packets. Export CSV saves the visible log to a file. On very busy networks the log may skip lines to stay responsive; it says how many it skipped (the dump file, if enabled, still records every packet). The sniffer captures IPv4 traffic only.

If file dumping is on, each packet is saved as a hex and text listing to dump.log in a per-user folder (%LocalAppData%\ProcessAndPortAnalyzer\dumps); use the link beside the checkbox to open it. When you start a new capture, any previous dump is kept by being renamed with a date and time stamp.

7. Firewall

Lists the firewall rules created by this app and lets you manage them.

• Click Add Rule… to open the rule dialog (see below).
• Use the search box to find a rule by name or program path.
• The Direction and Program columns show which way a rule applies and the program it’s limited to (Any if none).
• Right-click a rule to Enable, Disable, or Delete it.

Only rules created by Process and Port Analyzer are shown here, so you won't accidentally change unrelated Windows rules.

8. Creating a Firewall Rule

The rule dialog opens from Firewall → Add Rule…, or pre-filled from a Block listening port / Block connection / Block program’s network access action.

• Rule name — a name to identify the rule (required).
• Direction — IN (incoming), OUT (outgoing), or BOTH, which creates a pair of rules named “name (In)” and “name (Out)”.
• Action — BLOCK or ALLOW.
• Protocol — TCP, UDP, ICMP, or ANY.
• Local / Remote ports — leave blank for any, or enter:
  • a single port: 443
  • a list: 80,443
  • a range: 8000-8100 (low to high)
  • (Ports apply only to TCP and UDP.)
• Local / Remote addresses — type an address and click Add. Accepted formats:
  • a single IP: 192.168.1.10 or fe80::1
  • a subnet: 192.168.1.0/24 or 192.168.1.0/255.255.255.0
  • a range: 192.168.1.1-192.168.1.50
  • a keyword: LocalSubnet, DNS, DHCP, Gateway, Internet, and others
  • Leave the list empty to mean any address. Invalid entries are rejected with a message.
• Program — optionally limit the rule to one program; type its path or click Browse…. Leave it empty for any program.
• Profiles — the network types the rule applies to: Domain, Private and/or Public (all three by default).

Click Add Rule to save. The new rule appears on the Firewall tab. Rule names must be unique — Windows manages rules by name, so the app refuses a name that’s already in use.

9. Tips

• Colours and badges help you scan quickly — for example, protected system processes, established connections, and allow/block firewall rules are tinted differently, and labels like System, User, ALLOW, and BLOCK appear as badges.
• Click any column header on any list to sort; click again to reverse the order. Drag a column edge to resize it — widths are remembered between sessions.
• The app remembers your view: the tab you were on, the Processes filters (including Flagged only), the protocol and state filters, column sort and widths, and your auto-refresh interval are all restored the next time you open it.
• Search filters what is already loaded, so it is instant. Press F5 (or turn on auto-refresh) to pull in fresh data.
• Use Refresh any time to get the latest information for the current tab.
• If the app ever hits an unexpected error, the details are saved to %LocalAppData%\ProcessAndPortAnalyzer\crash.log — include that file if you report a problem.

10. Row actions

Every row on the Processes, Listening and Connections tabs ends with a set of action icons that mirror the right-click menu, so you can act without opening it:

The right-click menu adds Open file location, Copy path, and Block program’s network access…, which opens the rule dialog pre-filled to block that program on every port in both directions. Selecting several rows and choosing End process ends all of them, and the confirmation lists exactly what will be ended.

11. Privacy

Everything the app does is local to your machine, with one exception: the optional Geo-locate (online) checkbox on the Connections tab, which sends the remote addresses you are connected to — and nothing else — to a third-party lookup service. It is off unless you turn it on, and asks for confirmation first.

The AI Audit report is written to a window for you to copy; the app does not send it anywhere. CSV exports neutralise cells that start with =, +, - or @, so a crafted process or rule name can’t run as a spreadsheet formula.