NetPulse — Changelog

• The connection map now works out of the box. The world map on the

Connections tab plots your outbound traffic by location the moment you

install NetPulse — no setup, account, or download required.

• **Live packet capture and HTTPS hostname detection need no extra

download.** The Packets tab and the automatic naming of HTTPS

connections now use a capture capability built into Windows, so there's

no separate driver to install. (These two features require Windows 11

version 24H2 or later; everything else works on any supported Windows.)

• New "Live" tab — see what your apps are doing, in plain English. A

real-time feed of which apps are talking to which sites (with the

country and a category such as "Advertising" or "Analytics"), a privacy

summary of how many trackers were contacted and by which apps, and a

one-click shareable "receipt" image of your session. NetPulse never

lists its own traffic.

• **The Live tab now shows the full web address for unencrypted

requests.** When an app loads something over an insecure http://

connection, the feed shows the real page address it asked for — making

it clear what was exposed. Secure https:// traffic stays private, so

only the site name is ever shown there.

• Connections world map: Cities / Domains toggle. A new segmented

control in the top-right corner of the world map swaps the pill labels

between GeoIP city names (today's default) and registrable hostnames.

Domains mode rolls every IP that resolves to the same 2nd-level domain

into a single labelled cluster, so a CDN that fans out across dozens of

IPs reads as one google.com / cloudfront.net pill instead of a wall

of overlapping city names. Choice persists across restarts.

• Forward DNS observation populates hostnames automatically. NetPulse

now listens to the Windows DNS resolver and learns the actual name each

app asks for (e.g. teams.microsoft.com, github.com) as connections

open. The Connections grid, Top Domains panel, and Domains-mode map

pills fill in with service names instead of CDN infrastructure names.

No packet capture is involved — the OS resolver hands the names out

directly. (Doesn't catch DNS-over-HTTPS from browsers that bypass the

system resolver.)

• TLS hostnames learned automatically in the background. NetPulse

now passively reads the Server Name Indication (SNI) sent at the start

of every HTTPS connection on the default-route adapter, with no user

action required. Closes the DNS-over-HTTPS gap — Firefox with DoH on,

Chrome with Secure DNS — by getting the name off the wire rather than

asking the OS resolver. SNI overrides any previous hostname for the

same endpoint, since it's the most accurate forward signal available.

Requires Npcap (already used by the Packets tab); skipped silently

when Npcap isn't installed.

• **Installer + Connections tab now surface Npcap as a recommended

prerequisite.** The setup wizard shows an Npcap recommendation page

when it's not detected, with an option to open the Npcap download

page after install finishes. Inside the app, a dismissable banner on

the Connections tab points users at the download when Npcap is

missing.

Packets

• Live packet view — a new sidebar tab that shows the actual

packets flying to and from your network adapter, frame by frame.

Pick an adapter, click Start, watch them stream in.

• Live adapter activity in the picker — each adapter now shows a

colored dot and a live inbound rate (green when traffic is flowing,

"idle" when quiet, "link down" when disconnected), and your

default-route adapter is marked "active" — so you can pick the

right one before you click Start.

• Wireshark-style 3-pane layout — the packet list across the top

(timestamp, source, destination, protocol, length, info); a parsed

layer tree on the bottom-left (Ethernet → IP → TCP/UDP → application);

a hex + ASCII view on the bottom-right.

• Protocol decoders for ARP, IPv4, IPv6, TCP, UDP, ICMP / ICMPv6,

DNS / mDNS / LLMNR, TLS Client Hello (surfaces the SNI host name),

and HTTP request lines. Anything else shows as plain TCP / UDP with

raw bytes still available in the hex pane.

• Auto-follow — new rows scroll into view automatically while

you're at the bottom of the list. Scroll up to read a packet and the

view freezes; scroll back to the bottom and follow resumes.

• Bounded buffering — the live capture is throttled so a busy

network never overwhelms the window. You see a running

"X captured · Y displayed · Z dropped" counter so you know if any

frames were dropped due to overflow.

• Local-only — capture runs only while you have the Packets tab

open and have clicked Start. No packet contents are ever sent

anywhere; they live in memory and are discarded when you stop

capture or close the app. A separate packet-capture driver install

is required (one-time setup the empty state walks you through).

Keyboard shortcuts

• Ctrl+3 now opens the new Packets tab. The earlier `Ctrl+3 → LAN

Activity shifts one over: LAN Activity is now Ctrl+4`, Activity

is Ctrl+5, and Settings is Ctrl+6 (plus Ctrl+,, which keeps

working).

Various fixes

• Various fixes and improvements.

Devices

• Live list of every device on your local network, refreshed in real

time. Combines ICMP ping sweep, ARP, mDNS, SSDP / UPnP, and NetBIOS — even devices that don't normally announce themselves still

turn up.

• Rich fingerprinting: vendor (from MAC), manufacturer, model, serial

number, firmware, HTTP banner, and a clickable management URL when

the device exposes one. Apple model identifiers resolve to friendly

names ("iPhone 14 Pro", "Mac Studio (M1 Max)", "Apple TV 4K (3rd

gen)").

• 28 device categories with a fitting Material icon for each — phones,

tablets, laptops, routers, switches, NAS, printers, smart speakers,

cameras, doorbells, vehicles, and more. Custom Tux glyph for generic

Linux hosts.

• Operating-system inference covers macOS, iOS / iPadOS / tvOS /

audioOS / watchOS, Windows, Android, Tizen / WebOS, Roku, Sonos,

Synology DSM, QNAP QTS, Fire OS, the major Linux distributions, and

more.

• Brand grouping in the device list so all Apple, Sonos, Ring, etc.

devices cluster together regardless of category.

• Side panel for the selected device with the full fingerprint, open

ports, services, first / last seen, and a clickable admin URL when

available.

• Custom labels (renames) that persist across restarts.
• Live filter bar across name, IP, MAC, vendor, and custom label.
• "Newly discovered" pulse animation when a device first appears.
• Offline devices fade out instead of disappearing — full history is

retained.

• CSV export of the current device list.
• First-launch splash overlay during the very first scan so devices

don't snap in over several seconds.

Connections

• Live monitor of every outbound TCP / UDP socket on your machine.
• Per-process aggregation with extracted process icons, plus a

per-connection bandwidth bar (TCP).

• Header panel showing SENT / RECEIVED rates with a stacked sparkline

of the last 60 samples, plus rolling-peak and cumulative totals.

• World map of active endpoints over real terrain tiles, with each

remote endpoint plotted at its GeoIP location and arced back to your

machine. Sticky viewport — the map only grows, never jumps.

• City labels rendered as rounded white pills.
• Reverse-DNS resolution with a cache.
• Configurable connection-history retention (default 24 hours).
• Top-domains / top-processes summary below the map; detail card for

the selected endpoint.

• Optional GeoIP database integration for city-level geolocation.

LAN Activity

• Cross-references the Devices and Connections tabs and answers

*"which local apps are reaching which devices on my LAN?"*

• Grouped table by target device, plus a graph snapshot you can export.
• Highlights rows in amber when a connection's remote IP isn't yet a

known device — swaps in the real device as discovery catches up.

Notifications and tray

• Minimize-to-tray (X button still exits). Right-click the tray icon

for Show / Rescan now / Send test notification / Quit.

• In-window snackbar when NetPulse is visible, custom tray balloon when

it's minimized to the tray. Either way you find out about device

joins and leaves in real time.

• Device-join detection within ~ 2 seconds of a device grabbing an IP,

even if it doesn't announce itself on mDNS.

• Device-leave detection within ~ 2 seconds of an mDNS goodbye, with a

slower fallback path for devices that disappear silently — careful

not to false-flag idle iPhones as gone.

Activity tab

• Running, in-window log of every device join and leave the scanner

surfaces.

• Day grouping (Today / Yesterday / Mon 13 May), newest first, with

pill-coloured event badges and a reason for each event.

• Always records, regardless of whether the matching tray balloon was

shown — open the tab any time to see what you missed.

Keyboard shortcuts

• Ctrl+1..5 jump to Devices / Connections / LAN Activity / Activity /

Settings.

• Ctrl+, opens Settings (macOS convention).
• F5 or Ctrl+R triggers an immediate rescan.
• Ctrl+E exports the device list to CSV.
• Ctrl+Q quits.

Settings

• Light / Dark theme and accent colour.
• Scan interval, ICMP timeout, custom TCP port list, DNS cache TTL,

connection-history retention.

• Per-interface selector and custom CIDR override.
• GeoIP and Npcap status cards with one-click links to set them up.
• Notifications card: minimize to tray, notify on join, notify on

leave — all three toggleable independently.

• About card with the installed version and a *What's New* button that

opens the release notes for the current version.

• Anonymous usage data toggle. Off → no outbound network for telemetry

at all. On → only an anonymous per-install UUID + the feature you

interacted with is reported; never your IP, hostname, MAC address,

device list, DNS queries, or filter text.

Installation

• Now ships as a Windows installer with the .NET 8 runtime bundled —

no separate .NET download needed. Installs to Program Files, adds

Start-menu and (optional) desktop shortcuts, and registers a clean

uninstaller. EULA is shown at install time.

Various fixes

• Various fixes and improvements.