#NetDetect

A small Windows 11 tray app that notifies you when it first observes an application using the network. Built with C# / .NET and Microsoft's TraceEvent library.

#Run

Open dist\NetDetect\NetDetect.exe and accept the Windows administrator prompt. The packaged x64 build includes its .NET runtime; no separate runtime installation is needed.

On first launch, choose whether to learn silently for 30 seconds or notify immediately. Silent learning remembers only applications that actually use the network during that period. Afterward, newly observed applications generate a native Windows notification showing the executable name and first remote endpoint. Full paths are available in the application window.

Closing the window leaves NetDetect running. Find the teal network icon in the tray, possibly under the ^ hidden-icons menu. Double-click to open the remembered-app list. Right-click for:

Pause or resume monitoring.
Learn silently for another 30 seconds.
Include loopback traffic (off by default).
Start at Windows sign-in (off by default).
Send a sample notification.
Exit and stop monitoring.

The application window supports searching remembered paths, adding an executable to recognize silently, and forgetting one or all applications. Notify again for selected forgets that executable so its next observed activity can trigger another notification. It does not send an immediate sample alert.

#What counts as first activity?

First means first observed by NetDetect while running, across subsequent restarts. It cannot reconstruct activity from before installation or while closed/paused.
Applications are identified by full executable path, compared without case sensitivity. Multiple processes using that path share one notification. Replacing/updating the executable at the same path does not trigger another alert; moving it to a new path does.
TCP connections/accepts and TCP/UDP send/receive activity count, for IPv4 and IPv6. Traffic on existing connections also counts when first observed.
Internet and LAN activity count. Loopback (127.0.0.0/8, ::1) is excluded by default. An idle listening socket alone does not count.
Monitoring covers this Windows computer, including other processes running on it. It does not detect other devices joining a router or Wi-Fi network.
Shared hosts such as svchost.exe and browsers are treated as a single executable, not individual services, tabs, scripts, or extensions. Kernel activity is grouped as Windows System.

#Elevation and startup

The app runs elevated to access Windows kernel network events. Manual launches request administrator approval. No firewall settings or audit policy are changed, and no packet capture driver is installed.

Start at Windows sign-in creates an optional Task Scheduler task named NetDetect-<user SID> for the current elevated account, using an interactive sign-in trigger and highest available privileges. It launches the tray app after a short delay without a repeated UAC prompt. It stores no password. The task is created only when you enable this option.

Choose a permanent location for the published folder before enabling startup. If you move it, disable and re-enable startup from the new location. Startup and saved preferences belong to the account running the elevated app; using another administrator's credentials runs it as that other account.

#Local storage and notifications

Remembered applications, first endpoints, timestamps, and preferences are saved to %LOCALAPPDATA%\NetDetect\state.json. Writes replace the file atomically and retain the previous copy as state.json.bak. Unreadable JSON is preserved in a timestamped .invalid-* file before starting a new list. The app has no telemetry or outbound lookup requests and does not store packet contents.

Notifications are spaced nine seconds apart to reduce overwriting during a burst. The remembered-app list also records discoveries if a banner is missed. Windows controls actual display and duration: check Settings → System → Notifications, Do not disturb, and the tray menu's sample notification if banners do not appear. Queued banners are held in memory; exiting discards remaining banners, but recognized applications stay saved.

Kernel tracing can lose events under load; the application window reports Windows' lost-event count. Processes whose executable paths cannot be resolved are skipped and counted rather than attributed to an incorrect app. Very short-lived or protected processes can therefore be missed. The app shows an error if monitoring fails instead of claiming it is active.

#Build from source

Install the .NET 10 SDK, or place it at .tools\dotnet. Run from this directory:

.\build.ps1
.\build.ps1 -Publish

The second command creates the standalone Windows x64 executable in dist\NetDetect. The SDK is needed only to build. NuGet.Config uses the official NuGet feed, and packages.lock.json records dependency versions. No development server is required.

#Manual verification

Launch the packaged executable and accept UAC; confirm the window says monitoring is active.
Use Send a sample notification to verify Windows banner delivery.
Open an application that is not in the remembered list and cause network activity. Confirm its path appears and one notification arrives.
Cause more activity, restart that application, then restart NetDetect. Confirm the same executable stays recognized.
Select the executable and choose Notify again for selected. Further traffic should generate a new notification.
Check silent learning and pause/resume. During silent learning, new applications should appear as Silent; activity during pause should not be remembered.
If desired, enable startup and sign out/in to verify the tray app returns. Disable startup afterward if you do not want it.

Compilation and packaging can be checked without elevation. Actual event capture, banner delivery, and sign-in behavior require an interactive Windows session and have not been verified by the build alone.

#Remove

Disable Start at Windows sign-in, then choose Exit and delete the published folder. To erase remembered applications and preferences, delete %LOCALAPPDATA%\NetDetect as well. If the executable was already removed, delete its NetDetect-<user SID> task in Windows Task Scheduler.

#Implementation references

#License

TraceEvent is distributed under the MIT license; .NET and dependencies retain their respective licenses. Notices are included in the licenses folder.

Instalar en iPhone/iPad

Netdetect