Connection inspector
What the inspector shows for an app, a destination, a rule or several rows, and the actions in Change it.
Select a row in the Network Monitor and the inspector shows what Outbound knows about it. Toggle it with Inspector (⌥⌘I). It is 310 points wide, and never narrower than 250. Sections remember whether you left them open. In the Network Monitor, when the map sits beside the list, the inspector floats over the edge of the map instead of taking space from it.
An app
Section titled “An app”The header is the icon, the name and who signed it. Under it, two figures give what the app sent and received in the period the Network Monitor shows, or in the part of the traffic chart you selected. Point at them to read the period. Then:
- Rules now, with the same verdict switch as the row, and Temporarily to allow or block the app for a while. See Temporary rules and lifetimes.
- Traffic, with a switch between amounts and rates. Amounts are Destinations, Allowed, Blocked, Sent, Received and Last seen. Rates are Sending and Receiving now. Reset Counters counts from now for this app only, until Outbound quits; the section then says “Measured since TIME”, and Show All returns to the whole range.
- Telemetry… when Outbound has tracker information for this app. Its help is “See which telemetry companies APP reached and how to turn its telemetry off.”
- Connection Details for the period: the Host names, IP addresses, Ports and Protocols the app used, how many connections were Allowed and Blocked, and when it was Last allowed and Last blocked. “Addresses and countries are based on available observations. Counts may differ from the monitor.”
- Geographic Information: the Countries the app reached, or Multiple locations.
- Daily Data Limit. See Analytics.
- Speed Limit: cap the app’s upload, download or both. See Speed limits.
- Rules. Empty, it says “No rules yet. Connections follow the MODE default.” A long list grows a Filter rules field. A miss says “No rule for APP matches “query”.” Each rule says how often it has decided, such as “Decided 12 connections · last 4:06 PM”. Right-click a rule to Edit…, Turn Off or Delete it, or to raise or remove its priority. Matching global rules folds away the rules for every app that matched this app’s connections. New Rule… opens the editor filled in for this app.
- Helpers, when another process opened connections on this app’s behalf.
- Code Signature: Signed by (a developer name, Developer ID, Apple or Not verified), Identifier, Team, the signature Status (Valid, Invalid, Ad hoc, Unsigned or Revoked), Certificate issuer and Certificate type. Show Certificate… opens the signing certificate in the macOS certificate viewer.
- Process, the path, when one is known, with Show in Finder and Copy Path.
- Identity history: each path and code signature recorded for this app, with its team and when it was first and last seen. It warns when the recorded signature differs from the code on disk now.
A connection made by another user on this Mac shows only Another user and its traffic totals: “Only anonymous totals are shared. App, destination, and rule details are private.”
A destination
Section titled “A destination”Why says what decided the latest connection.
- “Decided by this rule:” and the rule, with Show Rule.
- “Decided by a rule that has since been changed or removed.”
- “Allowed while Outbound was paused.”
- “Allowed while Outbound is paused until this Mac restarts.”
- “Allowed while Outbound is paused.”
- When no rule covers it, a sentence for what happened: you allowed or blocked it once, nobody answered in time, the alert could not be delivered, Outbound was not running, Learn or Strict recorded it, or “No rule covers this yet.”
- A blocklist that decided names the list, when it was updated, and how many entries it has. In Change it, the blocklist badge names the exact entry and list that blocked it.
- “N other rules also match but rank lower.” when more than one matches.
- “Evaluated against the rules the filter enforces.” or “Evaluated against the saved rules; the filter is not connected.”
- All matching rules (N), with Decides on the rule that won. Each row’s help is “Show this rule in Rules”.
Explain appears when an on-device explanation is available, or when Outbound can say why it is not. The card is titled Explain and uses only the facts already on this inspector. See Explaining a connection.
Change it holds:
- Allow DEST for APP
- Block DEST for APP, with a button beside it that shows what blocking this connection is likely to break and how to undo it
- The blocklist badge, when a blocklist blocked it: “Blocked by LIST · ENTRY”. Its menu shows the entry and when the list was last fetched, and offers Show Entry in LIST, Disable Entry…, Allow for APP Only, Allow for Every App… and Turn Off LIST…. Allow for Every App… asks you to confirm separately and spells out the rule it saves: “Allow DEST for every app, with priority, on PORTS.” Disable Entry… changes the entry for every app, and Edit › Undo restores it.
- Block *.DOMAIN for every app, for a host whose domain can be named
- Temporarily: allow or block this destination for this app for 5 minutes, for 1 hour or until logout. While a timer runs it says how long is left, such as “Allowed for another 4 minutes”, with Cancel Timer. See Temporary rules and lifetimes.
- New Rule…, to open the editor filled in for this connection
The buttons are disabled when you may not edit rules. A press shows its pending state, including “Allowing…”, until it settles.
Connection Details lists Host or Address, Name source, Service, Last address, Port (or Any), Protocol, Direction (Incoming or Outgoing), Responsible app when a helper made the connection, Allowed, Blocked, First seen, Last seen, Last allowed and Last blocked. When closed connections have byte totals, it adds Sent (closed), Received (closed) and Closed connections. Reset Counters works as it does for an app.
Name source says where the host name came from:
- Supplied in TLS (SNI) or Supplied by the app’s connection request (or endpoint): the app named this server. “The app named this server; the name may differ from the server’s identity.”
- Corroborated by a DNS answer: “A DNS answer for this name returned the connection’s address.”
- Unknown: “The filter did not say where this name came from. Check the address before trusting it.”
Geographic Information lists City, Region and Country. With no location database: “Download the location database in Settings to see where this server is.” With a database that does not contain the address: “This address is not in the location database (often a private, relay or anycast address).” See Map and globe.
A rule
Section titled “A rule”The rule is shown as a sentence. A disabled rule is labelled This rule is off. Rule lists Action, Destination, Ports, Protocol, Direction (Incoming, Outgoing or Both), Lasts, Priority (High or Normal) and Profile. Identification lists the process, Owner and Created (Built in when the rule has no creation date). A note is shown when the rule has one, with Add Note… or Edit Note…, and Restore Original Note when the note differs from the one the rule was created with.
A rule made in 1.3.0 or later also says how it was made, for example “On 12 Oct 2026, Safari tried to connect to example.com; you chose Allow in an alert.” See How each rule records where it was made.
Not in effect gives the exact reason a rule is not deciding traffic, with a button where there is a fix:
| Reason | Button |
|---|---|
| “This rule is off.” | Turn On |
| “The profile “NAME” is not active.” | Activate Profile |
| “Outside its schedule.”, “This rule has expired.”, “The process this rule followed has quit.” or “The current session could not be verified.” | Edit Rule… |
| “The group “NAME” is off.” or “The list “NAME” is off.” | Open Group or Open Blocklist |
| “The network filter is off.” | Turn On Filter |
| “The code on disk does not match the code this rule was approved for.” | Review Identity… |
| “This rule has not been approved.” | Review Approval… |
| “A higher-priority rule decides this traffic first.” | Show Rule |
A rule you cannot change says why: Managed by your organization only when it is, “Settings are locked”, “Part of the blocklist “NAME”. It can only be turned off with the list.”, “Part of the trusted group “NAME”. It can only be turned off with the group.”, or “The rules file is read-only.”
Raise Priority… and Remove Priority… say what the change does before you save, for example “After this, “Allow Safari to example.com” decides example.com for Safari; “Block Safari anywhere” no longer does.” Saving needs your usual approval when it unblocks connections, and Edit › Undo takes it back in one step. A rule from your organization, a blocklist or a Trusted by default group keeps its priority.
Several rows
Section titled “Several rows”Select several apps or destinations in the Network Monitor or the Connection Log and the inspector reads “N Selected”, with how many destinations they cover and their Allowed and Blocked counts. Reset Counters for Selection resets them together.
With nothing selected
Section titled “With nothing selected”The inspector becomes a Summary: how many apps and destinations, the range, then Connections, Allowed, Blocked, To review, Mode, Top Apps, Top Domains and Top Countries. The closing line is “Select an app, a destination or a rule to see why it was allowed or blocked and change it in one click.” A row that has left the range says “This item is no longer in the selected range.”