Find endpoints shared by several apps with the Relations graph

The Relations tab draws your programs and the places they connect to as a graph, so you can see at a glance which apps are connecting to the same IP, domain, network or country. Apps are blue dots, endpoints are teal, an endpoint used by two or more apps turns orange, and anything touching a threat-feed address is red. It works on live traffic or on any stretch of your history.

The controls

A line at the right end of the controls sums it up, in the form "live · N apps · N IPs · N shared by ≥2 apps".

Reading the graph

• Blue nodes are programs; teal nodes are endpoints.
• Orange endpoints are shared: two or more apps talk to them.
• Red nodes and lines involve an address on a threat-intelligence feed (Plus, Family and Pro plans).
• Bigger nodes and thicker lines mean more data.
• A legend sits in the bottom-left corner.

Scroll to zoom, drag a node to move it, and hover over a node to highlight its connections and fade the rest. Double-click an endpoint to open its IP dashboard.

When the graph has to be trimmed to the Top N, shared endpoints are kept first. Live mode leaves out loopback traffic and connections that haven't moved any data, so the picture isn't cluttered with idle sockets.

Find apps connecting to the same IP

1. Open the Relations tab.
2. Set Source to Live for right now, or a range such as Last 7 days.
3. Set Relate apps by to IP.
4. Tick Only shared endpoints.
5. Click Fit, then hover over each orange node to see which apps share it.
6. Double-click a node for the address's dashboard, with totals per app.

If the result is mostly big cloud and CDN addresses, switch Relate apps by to Domain. That usually gives a cleaner picture of which services are actually shared.

What questions it answers

• Do these programs share a backend? Several apps from one vendor, such as an office suite and its updater, usually meet at the same domains.
• Is an unfamiliar program talking to the same place as a known one? An unknown helper that shares a domain with your backup software often belongs to the same product. One that shares nothing with anything you recognize is worth a look in its app dashboard.
• Where does most of my traffic go? Relate by ASN / Network or Country to see traffic collapse onto a handful of providers or countries.
• Did a flagged address reach more than one app? Red lines to one node from several programs deserve attention. Check what the feed says about it in Threat intelligence and detection.

In Live, each running process is its own node, so two copies of the same program appear twice. With a date range, NetSecWall combines them by program path.