Process & Port Analyzer

1. Getting Started

The status bar at the bottom shows whether you're running as ● Administrator or ○ User, along with a running count of items on the current tab.

The toolbar (top)

The sidebar (left)

Five summary cards show live totals: Running Processes, Listening Ports, Failed Logins, Firewall Rules, and Flagged for Review — how many processes the risk heuristics have flagged. Click that last one to jump straight to the Processes tab. They update automatically as you use each tab.

Keyboard shortcuts

2. Processes

Lists every running process with its icon, name, process ID (PID), memory use, peak memory, file path, architecture (32- or 64-bit), whether it’s a System or User process, and a Risk flag.

• Use the controls above the list to filter:
  • Hide Protected / Show All — hide or include protected system processes.
  • System / User / 32-bit / 64-bit checkboxes — narrow the list by type.
  • Sort by dropdown — order by Name, PID, or Memory.
• Type in the toolbar Search box to filter by name or path.
• Click any column header to sort by that column; click again to reverse.
• Double-click a process to see the modules (DLLs) it has loaded.

The Risk column

After the list loads, the app scores each process against a set of local heuristics and flags anything worth a second look as Medium or High. Hover a flag to see exactly why it was raised — for example an unsigned binary running from a temporary folder, a program using a Windows system name from the wrong location, or a script host launched by an Office application.

3. Listening

Shows processes that are listening for incoming connections, with the local address, port, owning process, and protocol (TCP/UDP).

• Filter by protocol or use the search box above the list.
• Right-click a row for:
  • Block listening port — opens the firewall dialog pre-filled to block that port.
  • Show details.
• Double-click a row to view that process's loaded modules.

4. Connections

Shows all active network connections (TCP and UDP): the owning process, local and remote address/port, and the connection state (such as Established or Listen).

• Filter by protocol and state, or use the search box.
• Right-click a row → Block connection to create a firewall rule for it. For an outgoing connection this blocks traffic to the remote address and port.
• Right-click → Resolve host name to look up the DNS name of the remote addresses in the selected rows.
• Tick Geo-locate (online) to fill in the Location column with each remote address’s country and city.
• Double-click a row to view that process’s loaded modules.

5. Failed Logins

Lists failed sign-in attempts recorded by Windows (requires Administrator).

Each entry shows the time (in your local time zone), user name, source IP, logon type, whether it was local or remote, and the related process ID. The 100 most recent matching events are shown, and the status bar tells you when that limit has been reached. Loading runs in the background, so the window stays responsive while Windows searches the Security log.

6. Sniffer

Captures live network packets on a chosen network address (requires Administrator).

If file dumping is on, packets are saved to a dumps folder next to the app (dump.log). When you start a new capture, any previous dump is kept by being renamed with a date and time stamp.

7. Firewall

Lists the firewall rules created by this app and lets you manage them.

• Click Add Rule… to open the rule dialog (see below).
• Use the search box to find a rule by name.
• Right-click a rule to Enable, Disable, or Delete it.

Only rules created by Process and Port Analyzer are shown here, so you won't accidentally change unrelated Windows rules.

8. Creating a Firewall Rule

The rule dialog opens from Firewall → Add Rule…, or pre-filled from a Block listening port / Block connection action.

• Rule name — a name to identify the rule (required).
• Direction — IN (incoming) or OUT (outgoing).
• Action — BLOCK or ALLOW.
• Protocol — TCP, UDP, ICMP, or ANY.
• Local / Remote ports — leave blank for any, or enter:
  • a single port: 443
  • a list: 80,443
  • a range: 8000-8100
  • (Ports apply only to TCP and UDP.)
• Local / Remote addresses — type an address and click Add. Accepted formats:
  • a single IP: 192.168.1.10 or fe80::1
  • a subnet: 192.168.1.0/24 or 192.168.1.0/255.255.255.0
  • a range: 192.168.1.1-192.168.1.50
  • a keyword: LocalSubnet, DNS, DHCP, Gateway, Internet, and others
  • Leave the list empty to mean any address. Invalid entries are rejected with a message.

Click Add Rule to save. The new rule appears on the Firewall tab.

9. Tips

• Colours and badges help you scan quickly — for example, protected system processes, established connections, and allow/block firewall rules are tinted differently, and labels like System, User, ALLOW, and BLOCK appear as badges.
• Click any column header on any list to sort; click again to reverse the order. Drag a column edge to resize it — widths are remembered between sessions.
• The app remembers your view: the tab you were on, the Processes filters, the protocol and state filters, column sort and widths, and your auto-refresh interval are all restored the next time you open it.
• Search filters what is already loaded, so it is instant. Press F5 (or turn on auto-refresh) to pull in fresh data.
• Use Refresh any time to get the latest information for the current tab.

10. Row actions

Every row on the Processes, Listening and Connections tabs ends with a set of action icons that mirror the right-click menu, so you can act without opening it:

The right-click menu adds Open file location and Copy path. Selecting several rows and choosing End process ends all of them, and the confirmation lists exactly what will be ended.

11. Privacy

Everything the app does is local to your machine, with one exception: the optional Geo-locate (online) checkbox on the Connections tab, which sends the remote addresses you are connected to — and nothing else — to a third-party lookup service. It is off unless you turn it on, and asks for confirmation first.