See the IP addresses that your computer communicates with, sorted by amount of packets transmitted. Shows GeoIP information (organization, country, region, and city) and a ping result for each address. Examples where this might be useful are monitoring suspicious internet connections and determining a game server's IP.

• Automatically stop monitoring: If enabled, monitoring will stop automatically after a certain amount of time. If disabled, monitoring will stop when the user clicks the "Stop monitoring" button (or uses the hotkey).

• Get location info for each IP address: If checked, every IP address entry will also show its owning organization name and geographical location information (see limitations). If unchecked, the results will be displayed a bit quicker.

• Ping each IP address: If checked, each IP address entry will also show the ping result to that IP. The pings are performed after monitoring is stopped and the results get updated in the table as they arrive.

• Protocol selection: If no protocol is selected, then all protocols will be counted. Otherwise, only packets of the selected protocols will be counted.

• Enable start/stop monitoring hotkey: Instead of manually pressing the start/stop buttons, you can use a hotkey. The hotkey is active globally, meaning it can be pressed while any other application is used and even when Who What Where is minimized to the system tray. The hotkey is used for both starting and stopping the monitoring.

• Read results using text to speech if the hotkey was used: If the text to speech feature is enabled and the hotkey is used to start or stop monitoring, the results will be read out to you - so that you don't have to look at the application screen. This is useful when you already know what you're looking for.

• Filter the results that are read out: Filter out what is read to you, the first few rows or only rows that contain a certain value in a certain column.

• Read values of these columns: Select which column values to read out, for example only organization and city.

• IP notes: See here.

• Right-click options: Right-clicking on a result in the table opens a pop-up menu with some useful options, one of which loads a website with more (or different) GeoIP information for the selected row's IP address (see also GeoIP Limitations).

Press a hotkey and hear the result of a ping sent to a predefined IP address or hostname. This is especially useful while playing online games. The ping result can be shown in a pop-up message or read out loud in one of several voices and languages (English, French, German, Italian).

Perform a traceroute for a given IP address or hostname and see the route plotted on a map as the trace progresses.

• Ping timeout: Sets the timeout for each of the 3 pings that are perfromed per hop.

• Resolve hostnames: Try to get the hostname of each hop. Keep in mind this might slow the trace down.

• Stop tracing if X consecutive hops haven't responded: Automatically stop the trace once it's not likely that another hop will be discovered, instead of waiting for the trace to end by reaching its maximum of 30 hops.

• Show/hide map pins: When the trace ends (either by reaching the destination hop or due to the user aborting the trace) you can show/hide any map pin on the route by checking/unchecking the map pin checkbox on the trace results table.

• Zoom in: Click the magnifying glass icon (in the "Zoom in" column) to see the exact location of the hop. The zoom level can be refined by clicking the arrows. Click the magnifying glass icon again to go back to viewing the full route.

• Right-click options: Right-clicking on a hop in the table opens a pop-up menu with some useful options, one of which loads a website with more (or different) GeoIP information for the selected row's IP address (see also GeoIP Limitations).

Inspects network traffic and checks if any packet matches a predefined filter. Filters include IP address or ranges (subnets), packet direction (incoming/outgoing), protocol, source/destination ports, and packet size. Upon finding a match, a predefined message will be displayed in a pop-up message or read out loud in one of several voices and languages (English, French, German, Italian).
This feature can be used as a notifier for an incoming connection, for example.

1. Create rules by clicking the 'Add rule' button (see "Adding rules" below). The created rules will appear in the rule list. The order of the rules in the list is important, because the rules are checked in the order they appear in the list; if a packet matches a rule then the rules below it will not be checked for that packet (for example, if rule #1 matches any UDP packet and rule #2 matches packets on port 1234, then UDP packets on port 1234 will match only rule #1). Rules in the list can be moved up/down by clicking the "Move selected rule up/down" buttons.

2. Choose one of two operation modes that determine what happens after a match is found:

   • Stop Watchdog: Once a match is found, Watchdog stops itself.

   • Keep Watchdog running: Watchdog keeps running until you stop it. If you choose this mode you need to specify a cooldown period, which is the minimal amount of time between getting Watchdog notifications; its purpose is to avoid flooding you with messages in case many matches occur one after the other.

3. Start/stop Watchdog by clicking the start/stop buttons or by using the hotkey. The default hotkey (Ctrl+NumPad Del) requires the numlock on your keyboard to be on.

Adding rules

In order for a rule to match a packet, all of the conditions set in this dialog must be fulfilled.

IP Address

Choose either IP address or IP note. If packet direction is selected, this condition will refer to the source IP address for incoming packets, and destination IP address for outgoing packets. If packet direction is not set, then this condition will refer to either source or destination IP addresses.

• IP address: Either a single IP address, or a range of addresses if a netmask is specified.

• IP note: Select an IP note, which can be mapped to more than one IP address. See here.

Packet Direction

If set, only incoming/outgoing packets will match. If not set, both incoming and outgoing packets will be matched.

Protocol and Ports

• Contains protocol: Only match packets that contain a layer of this protocol. Some protocols are implicit, for example HTTP naturally includes TCP.

• Source/Destination ports: Match packets with these TCP/UDP ports. If no protocol was selected, it will match both TCP and UDP packets that use the specified ports.

Packet Size

IP packet size: Match packets with an IP layer of the specified size. Note that the size is for the IP layer only (meaning IP layer and its payload which may include higher layers such as TCP and HTTP for example, but not the entire packet size which includes the lower layers like Ethernet etc).