Search and filters

The Network Monitor search, prompt “Search apps and places”, is a small field language. The Connection Log filter uses the same fields as tokens. Other searches are simpler: the Tracking Report (“Search apps, companies and servers”), Analytics (“Search apps, sites and countries”) and the map’s list of destinations without a place match words, not these prefixes.

How words match

Words are separated by spaces, and every word must match. Matching ignores case. Straight quotes or curly quotes keep a value together: app:"google chrome".

A word with no known prefix matches the app name, the host, the port or the place. It does not match protocol, rule or tracker on its own. An unknown prefix, such as an IPv6 address, is searched as the whole word.

Field	What it matches	Aliases
app:	the app’s name or its signing identifier
host:	the remote host or the last address	ip:, address:, domain:
port:	the port number or the service name
country:	the two-letter country code, exactly, such as country:ie
city:	the city, region or country name text	place:, region:
continent:	the continent of the destination’s country: af, an, as, eu, na, oc or sa, or its English name, such as continent:europe or continent:"north america"
owner:	the macOS user who made the connection: a user name, a user ID number, or unknown	uid:
proto:	the protocol, exactly	protocol:
direction:	incoming (incoming, in, inbound) or outgoing (outgoing, out, outbound). Any other word matches nothing	dir:
rule:	none, no, default or mode when no rule decided; any or yes when a rule did; unapproved when the deciding rule is waiting for your approval. Any other word matches nothing
kind:	a smart filter. An unknown word matches nothing	is:, smart:
tracker:	a catalogue company, by id or by whole words of its name. A company Outbound never blocks still matches	company:, vendor:

Smart filters

kind:, is: and smart: take the same words. In the Network Monitor the field offers them as tokens.

Filter	Meaning
kind:ai	AI Agents and Coding Tools. An app or host Outbound treats as an AI tool, or a site in the “ai” category. Aliases: agent, agents, llm
kind:ads	Ads and Trackers. Catalogue telemetry, including label-only rows. Aliases: ad, tracker, trackers, tracking, analytics
kind:unruled	Not Covered by a Rule. No rule decided the connection. Alias: norule
kind:new	Reached in the Last 15 Minutes. Last seen within 15 minutes. Aliases: recent, latest
kind:unsigned	Unsigned Apps. No developer team, and not signed by Apple. Alias: unknown-developer
kind:apple	Apple Services. Signed by Apple. Alias: system
kind:local	Local Network. A local address, or a name ending in .local. Aliases: lan, home
kind:abroad	Outside Your Country. The destination’s country is not this Mac’s. Missing either country does not match. Aliases: foreign, international
kind:heavy	Heavy Data Users. Sent plus received in the current range is at least 100,000,000 bytes. Aliases: data, bandwidth

kind:new follows the clock. kind:abroad reads this Mac’s country at the moment you search.

Example data.

Where a field appears

The Network Monitor always shows its field. Most other lists grow a field once they pass eight rows, and keep it while a query is typed. The map’s unlocated list uses its own threshold, the first page of 60. A search in the Network Monitor narrows the traffic chart to the same apps.