Networking explained
Ports, DNS, CDNs, TCP states and the other plumbing, in plain language.
Encrypted DNS (DoH): what it hides, and from whom
DNS over HTTPS encrypts the names your PC looks up, so the Wi-Fi owner and your ISP can't read them. The resolver you use still sees every name, and the addresses you then connect to stay visible.
How accurate is IP geolocation?
IP geolocation is usually right about the country and often wrong about the city. It's an educated guess from registry records and network measurements, and CDNs, anycast and VPNs throw it off.
How NetSecWall sees every connection without a driver
NetSecWall reads what Windows already records: kernel network events through ETW, DNS answers, and the TCP and UDP tables. It sees which app talks to which address without capturing a single packet.
Inbound and outbound connections, in plain English
A connection is outbound when your PC starts it, inbound when another machine does. Your router and Windows Firewall stop most unsolicited inbound traffic, so outbound is where apps phone home.
What is a port? 443, 53, 3389 and friends
A port is a number from 0 to 65535 that tells a computer which program a piece of network traffic is for. Servers wait on well-known ports like 443 or 53; your side uses a random high port.
ESTABLISHED, TIME_WAIT, LISTENING: TCP states decoded
TCP states show where a connection is in its life: LISTENING waits, SYN_SENT is dialing, ESTABLISHED is talking, CLOSE_WAIT and TIME_WAIT are the goodbye. Most are harmless; piles of some are clues.
What is svchost.exe doing on my network?
svchost.exe hosts Windows services, and several of them need the internet: Windows Update, BITS, Delivery Optimization, time sync and the DNS Client. The real question is always which service.
Why every app connects to Cloudflare, Akamai and Amazon
Most software companies don't serve their apps from their own servers. They rent content delivery networks and cloud platforms, so the address owner you see is usually the host, not the company.
What is the Windows Filtering Platform?
The Windows Filtering Platform (WFP) is the engine inside Windows that decides whether network traffic may pass. Windows Defender Firewall is built on it, and so are many VPNs and security tools.