Help & Documentation

Quick Start

WhosConnected is a Windows desktop app that shows you every device, connection, and process on your network in real time. Here's how to get up and running in under two minutes.

1. Launch the app. Double-click WhosConnected.exe. The Dashboard opens immediately and starts collecting live connection data.
2. Set up your router (optional but recommended). Go to Settings and enter your router brand, IP address, and admin credentials. This unlocks LAN device stats, NAT sessions, and signal strength data. See Router Setup below.
3. Run as Administrator for full features. Right-click the shortcut and choose Run as administrator to enable packet recording, DHCP fingerprinting, ARP sweep, and the security event log.
4. Explore. Click any connection on the Dashboard map, select a device in Local Network, or open a recording in the Recordings tab. Press F1 at any time for help on the current tab.

Admin Mode

Most features work without admin rights. A handful require elevated privileges because they interact with low-level Windows APIs:

To always launch as Administrator, right-click the shortcut → Properties → Advanced → tick Run as administrator.

Router Setup

WhosConnected integrates directly with your router to show connected devices, NAT sessions, signal strength, and download/upload rates per device. Without router integration the app still works — it just won't have per-device LAN stats.

Supported routers

• Sagemcom / Eir Hub — fully supported
• ASUS (ASUSWRT) — fully supported
• OpenWrt — fully supported (LuCI JSON-RPC must be enabled)
• TP-Link — coming soon

How to connect

1. Open the Settings tab.
2. Select your Router Brand from the dropdown.
3. Enter your router's IP address (usually 192.168.1.1 or 192.168.0.1).
4. Enter your router username and password (the same ones you use to log into the router's admin page).
5. Click Test Connection. A green tick means it's working.
6. Restart the app to apply the new router brand if you changed it.

Troubleshooting router connection

• Make sure you're on the same Wi-Fi or LAN as the router.
• Check your router's admin credentials — some routers use admin / admin, others use the password printed on the label.
• For OpenWrt, LuCI and JSON-RPC must be installed and enabled.
• Click Diagnose in Settings for a detailed connection report.

📊 Dashboard

The Dashboard is the default landing page. It gives you a real-time overview of your machine's internet activity.

KPI bar

The three tiles at the top show your current active connection count, total download rate, and total upload rate, updated every two seconds.

Live map

The left panel shows a world map with animated markers for every active TCP connection. Each marker is coloured by the process that owns the connection. Click any marker to select that connection and highlight it in the connections table below.

Click ⤢ World Map (top right of the KPI bar) to open the map in a larger floating window — useful on a second monitor.

Bandwidth charts

The right panel shows two scrolling charts:

• Process Bandwidth — one line per process, coloured consistently. Shows the last ~5 minutes of activity.
• Connection Bandwidth — one line per active TCP connection.

Top active connections

A scrollable table of your busiest connections, sorted by current bandwidth. Columns show process name, destination hostname, port, download/upload rates, and TCP state. Click any row to select it — the map marker highlights and a traceroute fires automatically.

Connections table

The full connections table is embedded below the strip. It shows all active TCP connections with detailed columns including ISP, country, CDN provider, and geolocation. Right-click any row for options including traceroute and packet recording.

🖧 Local Network

The Local Network tab shows every device on your LAN — discovered via ping sweep, ARP table, and your router's device list — in a hub-and-spoke topology diagram.

Topology diagram

Each node represents a device. The central node is your machine. You can drag nodes to rearrange them, scroll to zoom, and click any node to open its traffic panel on the right.

Node styles indicate how the device was discovered:

• Standard border — found via ping scan and/or ARP
• Purple dashed border + 📡 — seen by the router only (not responding to pings)
• Indigo border + ✔ — confirmed by both router and local scan

Device traffic panel

Click a node to open its panel on the right side. For LAN devices it shows router-reported download/upload rates, Wi-Fi signal strength, link rate, connected time, and total bytes transferred. For This Machine it shows a per-process bandwidth breakdown.

Device table

Below the diagram is a collapsible table listing all discovered devices with columns for IP, hostname, vendor, model, MAC address, IPv6, and live bandwidth rates.

Search / filter

Type in the search box to filter — matching nodes stay bright, non-matching nodes dim in the diagram, and the table filters to matching rows only.

Security features

When running as Administrator, the Local Network tab also monitors for:

• ARP spoofing — alerts if a device's MAC address changes unexpectedly
• DHCP fingerprinting — identifies device OS/type from DHCP broadcast packets
• Security Event Log — shows relevant Windows security events (logon failures, etc.)

📶 Traffic

The Traffic tab shows bandwidth usage in detail, with two views toggled by the buttons at the top.

💻 This Machine

Shows per-process bandwidth for your own machine, with a drill-down table of individual TCP connections per process. Data comes from the Windows TCP ESTATS API — accurate per-connection byte counts, not estimates.

🌐 LAN Devices

Shows bandwidth per device as reported by your router's NAT session table. Requires router integration to be configured in Settings. The table has 18 columns (6 visible by default) — click the ⚙ column picker icon to show/hide columns.

🔌 Ports

The Ports tab lists all open listening ports on your machine — services and processes that are accepting inbound connections. Useful for identifying unexpected services or checking what's reachable from outside your network.

Each row shows the local port, the process name that owns it, the protocol (TCP/UDP), and the bind address. A bind address of 0.0.0.0 means the port is listening on all interfaces and reachable from your network.

⏺ Recordings

The Recordings tab lets you capture, browse, and analyse network packet recordings in .pcapng format using Windows' built-in pktmon tool.

Starting a recording

A Record button appears in the Connections tab toolbar when you're running as Administrator. Click it to start a recording — pktmon captures all packets and saves them as a .pcapng file in the output folder set in Settings.

Browsing recordings

All .pcapng files in your output folder appear in the Recordings tab, sorted by date. For each recording you can:

• Open in Wireshark — launches Wireshark with the file (Wireshark must be installed)
• Analyse — opens the built-in packet analysis dialog with a parsed packet table and deep-dive decode
• Show in Explorer — opens the containing folder
• Delete — permanently removes the file

Built-in packet analysis

The analysis dialog shows a packet-by-packet breakdown parsed in-app — no external tools needed. Switch to the Deep Dive tab to stream a full tshark decode of each packet. tshark is installed alongside Wireshark.

⚙ Settings

Recording

• Output folder — where .pcapng files are saved. Defaults to Documents\WhosConnected\recordings.
• Max duration — automatically stops a recording after this many minutes.
• Auto-delete .etl files — pktmon generates intermediate .etl files; enable this to clean them up after conversion.
• Open in Wireshark automatically — launches Wireshark with the recording as soon as it stops.

Router

See Router Setup above for full instructions. The Diagnose button runs a detailed connectivity test and shows exactly where the connection is failing. The Probe XPath button is an advanced tool for inspecting the raw router API response.

Diagnostics

The Diagnostics card shows live status of all system dependencies — admin rights, pktmon availability, ESTATS (bandwidth API), and Wireshark detection. This is the first place to look if something isn't working.

🔑 Activating your licence

After purchasing, you'll receive a licence key by email in the format XXXXX-XXXXX-XXXXX-XXXXX.

1. Open the About tab in WhosConnected.
2. Type or paste your key into the licence key field.
3. Click Activate. The app contacts the activation server to verify your key and bind it to your machine.
4. Once activated, the About tab shows a green ✓ Activated badge. You're done — no internet connection is needed for any future launches.

💻 Moving to a new PC

Your licence is tied to the machine it was first activated on. If you get a new PC, email us and we'll reset the binding so you can activate on your new machine.

1. Email support@store.whos-connected.com with the subject Licence Transfer.
2. Include your licence key (or the email address you used to purchase).
3. We'll reset the activation within 24 hours and reply to confirm.
4. Install WhosConnected on your new PC and activate using the same key.