I had closed the apps I was actively using, finished writing for the day, and left my HP laptop sitting at what looked like an idle desktop. There wasn’t much happening on screen, but that doesn’t mean Windows had stopped talking to the internet. Browsers linger in the background, cloud apps keep syncing, services check for updates, and Windows has plenty of networking work of its own.

I wanted to see which servers my PC was talking to without me doing anything, which led me to Portmaster, a free network monitor and application firewall from Safing. Once it was running, the supposedly quiet desktop became considerably busier. The connection graph started moving, applications appeared in the sidebar, and the network activity page filled with connections from processes I wasn’t actively using.

The sheer volume of background noise

My idle desktop had a surprisingly busy social life

Watching Portmaster populate for the first few minutes was what sold me on the idea. At one point, my dashboard showed 142 blocked connections, 156 active connections, and 35 active apps. The broader Network Activity view eventually contained 546 connection records.

Those numbers need some context. They don’t mean 546 apps secretly sent information somewhere, and the 142 blocked connections weren’t all suspicious outbound traffic. Portmaster also records unsolicited incoming connections, repeated connections to the same endpoint, and what it labels as network noise. One of my later views, for example, attributed 68 blocked connections to Network Noise alone.

Nevertheless, I was surprised by the amount of background activity. Applications have perfectly ordinary reasons to stay online when I’m not touching them. They check for updates, synchronize data, maintain notification channels, resolve domains, and contact the services they depend on. Seeing an unfamiliar destination in Portmaster doesn’t mean the app is spying on you.

What Portmaster gives me is somewhere to see those connections in context. It ties network activity back to the responsible application. It can show the destination domain or IP address, the country associated with that address, the protocol, direction, and whether a connection was allowed or blocked. Windows’ own Resource Monitor can also dig much deeper into process-level network activity than Task Manager, but I found Portmaster’s presentation much easier to make sense of than staring at raw addresses and wondering which process created them.

There’s an important limit here, too. Portmaster can show me that an application is connected to a server, but it generally can’t tell me what information passed through an encrypted HTTPS connection. HTTPS protects the contents of traffic while still leaving some connection metadata visible. I’m looking at the connection metadata, not a decrypted transcript of whatever the app sent.

I could investigate a connection and block it from the same place

Following the connection trail was easier than I expected

Once the list started filling up, I wanted to know what individual applications were doing rather than stare at the overall connection count. I filtered the activity down to Brave first, mostly because a browser generates enough traffic to make a good test case.

Portmaster showed me the IP address behind each connection, the protocol being used, whether it was encrypted, the organization behind the destination when it could identify one, and the rule that decided whether the traffic was allowed. One expanded Brave connection, for example, was an outgoing encrypted UDP connection to a Google-owned address. Other entries included Cloudflare endpoints.

That isn’t particularly scandalous for a browser, but it showed me how much detail Portmaster could attach to a connection. The more interesting entries were background processes I hadn’t gone looking for. An Intel Telemetry Agent executable appeared among my applications even though I had no Intel utility open on the desktop, and Portmaster had logged a connection from it. Portmaster also exposed the executable responsible, down to C:Program FilesIntelTelemetryAgenttelemetry_agent.exe I wouldn’t infer from that alone that Intel was collecting anything sensitive. A recorded connection only tells me that the process is communicated over the network. Still, this was exactly the kind of background activity I wanted a tool like Portmaster to surface.

Windows Firewall can already create detailed inbound and outbound rules, so Portmaster isn’t unlocking a capability Windows completely lacks. The advantage for me is the workflow. Windows Firewall’s rule interface can get confusing quickly, particularly when I approach it through Advanced Security and have to already know which program, port, or address needs a rule. Portmaster starts with the activity itself. I can spot a process, inspect its recent connections, and act on it without jumping between several Windows tools.

That became even clearer when I opened the Intel Telemetry Agent profile. A block connections switch lets me cut the application off completely. Portmaster also supports narrower rules when blocking an entire program would be excessive, including rules for specific domains and other connection criteria.

There’s plenty of room to break things if you get carried away here. Login systems, cloud syncing, licensing checks, notifications, and other features can depend on destinations that look meaningless at first glance. I found Portmaster most useful when I treated blocking as an experiment. If an app stopped working after I changed a rule, the recent activity made it fairly easy to find what had been blocked and undo the change.

The filtering works beyond my browser

The rest of Windows gets its own filter list too

I initially expected most of the useful work to be manual, but Portmaster can also automatically filter out known unwanted destinations. Its global Privacy Filter includes lists for advertising and tracking services, malware-related domains, and several more specialized categories.

I enabled the main Ads & Trackers and Malware categories during setup. Because those rules operate at the network level, they aren’t confined to whichever browser happens to have an ad-blocking extension installed. Portmaster can apply them to traffic from desktop software, Windows components, WebView-based applications, and other processes on the machine.

That broader coverage is useful, although I wouldn’t throw away a browser content blocker because of it. Browser extensions have much greater awareness of what’s happening on a webpage and can handle features such as cosmetic filtering that Portmaster isn’t designed for. Portmaster covers the part they can’t see: everything on the PC that lives outside the browser.

Secure DNS is bundled into the same system-wide setup. Portmaster can encrypt DNS queries and lets me choose providers, including Cloudflare, Quad9, and AdGuard, instead of configuring encrypted DNS separately for individual applications. I used Cloudflare during my test, and the Global Settings page exposed the DNS-over-TLS servers directly if I wanted to change them later.

Most of the useful stuff is already free

Free actually means useful here

Portmaster gets recommended as a free utility often enough that I wanted to know how quickly I’d run into a paywall. For what I was doing, surprisingly little was locked away.

The free version gave me the live network monitor, application-level connection controls, global filtering, Secure DNS, and the ability to inspect and block connections. That covers nearly everything I needed to figure out which applications were reaching the internet and decide whether I wanted them to continue.

The paid tiers focus more heavily on investigation and privacy features. Portmaster Plus costs around $46 per year and adds persistent Network History and Bandwidth Visibility, among other extras. The distinction matters because the free version only gives me a short recent window of network activity rather than a searchable long-term history.

Portmaster Pro costs a little over $9 per month and adds Safing’s Privacy Network, or SPN. It routes connections through multiple hops, the same broad idea behind multi-hop routing in privacy tools, and can give individual applications different internet identities and exit locations. That’s well beyond what I installed Portmaster for, and I never needed to subscribe to answer the basic questions that started the experiment.

I mostly wanted somewhere to look when something seemed odd

I don’t plan to sit in Portmaster watching connections scroll past every time I use my laptop. Spend long enough doing that and perfectly ordinary traffic starts looking suspicious simply because you don’t recognize the domain.

What I wanted was somewhere to look when an unfamiliar process appears, an application behaves strangely, or I wonder why a program needs an internet connection in the first place. Portmaster gives me that without making me dig through Windows Firewall rules before I even know what I’m looking for.

I’ve kept it installed for that reason. I can see which application opened a connection, where that connection went, and what Portmaster did with it, then block it if I have a good reason to. For something I can use without paying for Plus or Pro, that’s enough to earn a permanent spot on my laptop.