Skip to content
The XG Series hardware appliances will reach end-of-life (EOL) on March 31, 2025. Click here to see the XG to XGS migration documentation.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/21.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=live-connections

Live connections

You can see the connection details of IPv4 and IPv6 traffic for applications, usernames, and source IP addresses.

You can see the data transfer, bandwidth consumed, number of connections, and other traffic details.

  • To refresh the connection details automatically, select the Automatic refresh interval from the list.

  • To refresh manually, click Refresh.

    Refresh the connections.

  • To see the number of current connections, see Live connections in the upper left corner.

    Current connections.

Live connections list

The live connection details shown are from the time a connection was established. For example, upload transfer is for total data uploaded from the time the connection was established.

To see the live connection details, select one of the following:

  • Application
  • Username
  • Source IP address

The list shows the details of current connections as follows:

Option Description
Application

Shows the connected applications.

Other applications: Unrecognized applications and system-generated traffic, such as DNS queries and replies when the firewall is the DNS server, signature downloads, and console access.

DNS: DNS traffic to which firewall rules apply, for example traffic between an internal source and external DNS servers.

System-generated DNS traffic is listed under both DNS and Other applications.
Source IP address Source IP address of the traffic.
Username User who initiated the connection.
Upload transfer Total amount of data uploaded, in bytes.
Download transfer Total amount of data downloaded, in bytes.
Upstream bandwidth Total upstream bandwidth used. It's the total transferred bytes divided by the total connection time (in seconds).
Downstream bandwidth Total downstream bandwidth used. It's the total transferred bytes divided by the total connection time (in seconds).
Characteristics Application details, such as application category and usage.
Total Total number of connections for the application, username, or source IP address.

How to see the details

  • To see all the items in an application, username, or source IP address, click Expand button..

    Expand the object.

  • To sort a column in the list, click the heading.

  • To apply a filter, click Filter button., select a modifier, and enter the search phrase. You can apply one filter at a time. To clear an existing filter, click Clear.

  • Click the Total to see the connection details.

    This opens a new tab.

    Total connection details.

    You can see the start time, inbound and outbound interfaces, source and destination ports and IP addresses, protocols, firewall and NAT rule IDs, and the total and live data transfer.

    Note

    The firewall rule ID of system-generated traffic is set to zero because firewall rules don't apply to this traffic. It's controlled by the Local service ACL. See Access to local services from zones.