What the page is showing
The Connections page lists sockets that are alive right now, not a history. Close a row and that request is cut. The upload and download figures at the top are live rates, not cumulative usage.
The default columns are host, downloaded, uploaded, Chains, rule, process and start time. Read Chains from right to left: the rightmost entry is the group that matched first, the leftmost is the node the traffic finally left through. It is the most direct evidence you have when routing goes wrong.
Three problems it solves quickly
- 1
A site is not using the proxy
Type the domain into the filter box and see whether it appears. If it does, look at the rule column. DIRECT means a direct rule matched; MATCH means the catch-all picked it up. Either way the fix belongs in your rules.
- 2
Find what is using the bandwidth
Sort by downloaded and read the process column. Process names are usually complete in TUN mode; in system proxy mode some connections have no process attached, which is normal.
- 3
An unusual number of connections
Download managers and sync clients happily open hundreds of long-lived sockets. Use close all connections once. If the count climbs straight back within seconds, the process column tells you who is responsible.
Why the traffic numbers never match
This page only counts traffic that passed through the core. DIRECT connections are included, but anything that bypasses the core entirely, such as addresses in your bypass list, never appears. So the figure is usually lower than your system network monitor, and it will not match your provider dashboard either, because providers bill at the exit and include protocol overhead and retransmissions.
- Switching profiles rebuilds every connection and resets the counters
- Closing all connections does not disable the proxy; apps simply reconnect
- Leaving this page open keeps a live stream running, which costs a little CPU
Common questions
What does a chain containing only DIRECT mean?
That connection went through no proxy group at all and left directly from your machine. Either a DIRECT rule matched it, or the address is in your bypass list.
The process column is always empty. Is something broken?
No. Process matching requires the core to read the local socket table. It works more reliably in TUN mode and is often incomplete under a system proxy. It does not affect routing, only your ability to write process-based rules.