Skip to content
The XG Series hardware appliances will reach end-of-life (EOL) on March 31, 2025. Click here to see the XG to XGS migration documentation.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/21.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=live-connections

Live connections

The Live connections page lets you view and manage live IPv4 and IPv6 connection data, including upload and download amounts, bandwidth usage, application, user, source IP address, protocol, and firewall rules. You can refresh, filter, sort, and expand connection entries for deeper inspection.

You can see the total number of Live connections at the top of the list.

Select an Automatic refresh interval from the list to refresh the connection details automatically or click Refresh to refresh the connections manually.

Live connections list

The live connection details shown are from the time a connection was established. For example, upload transfer is the total data uploaded from when the connection was established.

You can see the data transfer, bandwidth consumed, number of connections, and other traffic details for each connection.

To see the live connection details, select one of the following:

  • Application
  • Source IP address
  • Username

The list shows the details of current connections as follows:

  • Application: Shows the name of the connected applications.

    Note

    Other applications shows details for unrecognized applications and system-generated traffic, such as DNS queries and replies when the firewall is the DNS server, signature downloads, and console access.

    DNS shows DNS traffic to which firewall rules apply, for example, traffic between an internal source and external DNS servers. System-generated DNS traffic is listed under both DNS and Other applications.

  • Source IP address: The source IP address of the traffic.

  • Username: The user who initiated the connection.
  • Upload transfer: The total amount of data uploaded.
  • Download transfer: The total amount of data downloaded.
  • Upstream bandwidth: The total upstream bandwidth used. It's the total transferred bytes divided by the total connection time (in seconds).
  • Downstream bandwidth: The total downstream bandwidth used. It's the total transferred bytes divided by the total connection time (in seconds).
  • Characteristics: Application details, such as application category and usage.
  • Total: Total number of connections for the application, username, or source IP address.

How to see the details

  • Click Expand button. to see all the items in an application, username, or source IP address.

    Expand the object.

  • To sort a column in the list, click the heading.

  • To apply a filter, click Filter button., select a modifier, and enter the search phrase. You can apply one filter at a time. To clear an existing filter, click Clear.

  • Click the number in the Total column to open the connection details in a new tab.

    Total connection details.

    You can see the start time, inbound and outbound interfaces, source and destination ports and IP addresses, protocols, firewall and NAT rule IDs, and the total and live data transfer.

    Note

    The firewall rule ID of system-generated traffic is set to zero because firewall rules don't apply to this traffic. It's controlled by the Local service ACL. See Access to local services from zones.