NetGeoAudit / your network event log at a glance

A log of every network event. Filter by port, time, geolocation, app, DNS and more. RDP monitoring — location, password and username guessing, disconnects. Ready-made country IP-range templates for firewall rules.

  • Connection monitoring with search
  • IP geolocation
  • RDP control by country
  • Firewall rules with country templates
  • Windows service management
  • Export & event archive
v2.0.0 · July 2026 Windows 10 / 11 Local · no telemetry Free edition
Download freeportable Buy a key What it does
License

Perpetual, one machine

5000 ₽ one-time · no subscription
  • Free edition — available indefinitely, no time limit, but with reduced functionality
  • Full license unlocks every feature without restriction
  • Perpetual key after purchase; v1.x updates included
  • One machine per key; volume discounts from 5+
  • Commercial use allowed
Download NetGeoAuditportable Buy a key Free to download and use · key purchased separately

Buy a license / via QR code

/ 5000 ₽
QR code to pay for a NetGeoAudit license
5000 ₽
enter the amount manually on the payment page
Scan the QR code with your banking app. On the payment page enter the amount of 5000 ₽ manually and confirm the transfer.
Fill in the form on the right: your name exactly as in the payment (so we can match it), your email, and the Application ID (shown in the app's registration window).
We verify the payment and email you a payment confirmation.
After the email, open the registration window in the app and press “Register” — the license activates automatically (internet required).

Activation details

Submit after payment — we'll match your transfer and email you a confirmation, then you press “Register” in the app.

Open the registration window in the app — it shows "Your ID"; copy it with the button.

Features / what it does

/ features

Connection monitoring

A live list of inbound and outbound connections: which program is connecting, where and on what port, what the firewall allowed or blocked. Handy search over any fragment — IP, domain, country, or process name. See at a glance who is connecting and where right now.

IP geolocation

Every connection is instantly enriched with country, city, and ISP by IP. A separate IP lookup and a Traceroute that geolocates every hop along the route. Databases are installed locally — no internet needed for this.

RDP control

A dedicated monitor for remote access over RDP: who connects, from which country, under which user, and password-guessing attempts. You can allow RDP only from the countries you need and block everything else.

Firewall rules

Create Windows Firewall rules from IP ranges, a list file, or an entire country. Ready-made country range templates — pick a country, get a rule. Safe block asks for confirmation before it's applied.

Rule audit

A breakdown of every active firewall rule with a 5-level risk score and grouping by program. Filters by profile, action, state, and protocol. Check suspicious files through VirusTotal.

Services & drivers

Every Windows service — and kernel drivers behind a filter — in one table: name, system name, description, state, and startup type. Substring search across name, description, and file path at once. Check what you need and start or stop it in one click. The service card changes the startup type and opens the service file.

Export & archive

Export any log to TXT or HTML with search right inside the report. Archive mode lets you open events from an earlier period — a chosen day and time range — to review what happened before.

Screenshots / what it looks like

07 / views
Main window — every live monitor in one place Net Log Live
NetGeoAudit main window: monitors for ports, connections, firewall (block/allow), RDP and sign-in, plus a session log
Active connections — everything connected right now country · city · ISP
Active network connection monitor: protocol, state, local and remote IP, ports, country, city, ISP, app and DNS, with filters and search
Ports — who's listening and where traffic goes search · filters
Port monitor: protocol, port, IP, country, city, ISP, process and DNS with TCP/UDP filters and port search
Blocked connections — live log and archive by period archive · geolocation
Blocked-connection monitor in archive mode: direction, protocol, ports, IP, country, city, ISP, app, rule and DNS over a chosen date range
RDP monitoring — who signs in over remote desktop location · login · guessing
RDP monitor: IP, country, city, ISP, event (connect, login, disconnect, block IP) and user name, with history over a period
Firewall rules — rules by IP, country, or file country templates
Firewall Builder: IP range from a file, by country, or manual, rule name, Allow/Block/Safe Block action, TCP and UDP ports
Rule audit — firewall rules with risk scoring risk score
Control Rules: rules, apps with risk indicators and groups, filters by profile, action, state and protocol, rename and edit IP

Tech / how it's built

/ stack

NetGeoAudit is written in .NET 10 and C# using WPF and the WPF-UI library for Fluent Design. Architecture is MVVM via CommunityToolkit.Mvvm, dependencies are injected through Microsoft.Extensions.DependencyInjection.

Under the hood: Windows Filtering Platform (WFP) and Event Log Watcher for live monitoring, the COM interface HNetCfg.FwPolicy2 for firewall rule management, Microsoft.Data.Sqlite for local storage, MaxMind GeoLite2 (City + ASN) for geolocation.

The "local and quiet" principle: all databases are offline, no external APIs for core functionality, no telemetry. A public IP is looked up only on explicit user request via ipify.org.

FAQ / common questions

/ faq
Do I need administrator rights?

Yes, for most features: WFP monitoring (Firewall Block/Allow), Windows Event Log reading, firewall rule management, registry and WMI geo-audit.

Without admin rights only IP Lookup, Traceroute, and part of Net Log Live work. Launching without admin shows a red "Run as admin" button on the main screen — one click restarts the app with the right privileges.

How does the free edition differ from the full one?

The free edition is available indefinitely, with no time limit — download it and use it as long as you like. But functionality is limited: some monitors and tools run in a reduced mode.

The full license (5000 ₽, perpetual, one machine) unlocks every feature without restriction. Pay, get the confirmation email, press “Register” in the app, and keep working with the full toolset.

How do I buy and activate a license?

Pay via the QR code in the Buy section: scan it with your banking app and enter the amount of 5000 ₽ manually on the payment page.

Then fill in the form — your name exactly as in the payment (so we can identify the transaction), your email, and the Application ID (shown in the registration window as "Your ID").

We verify the payment and email you a confirmation. After that, press “Register” in the app — the license activates automatically (internet required; we do not send a key).

Does NetGeoAudit send my data anywhere?

No. Geolocation uses offline MaxMind GeoLite2 databases (City + ASN) shipped with the app. Firewall rules are stored in SQLite on your machine. No telemetry, no cloud, no analytics.

The only place the app talks to the internet is a public-IP lookup via api.ipify.org when you start Win Geo Audit, and the license check. This can be disabled in Settings.

How is NetGeoAudit different from Wireshark?

Wireshark is a packet analyzer at the network-adapter level (libpcap/npcap). It sees every packet with every protocol header — a powerful tool for protocol decoding.

NetGeoAudit works through Windows Filtering Platform (WFP) and Event Log. It shows firewall-level events: which connection is allowed, which is blocked, which program started the traffic, which rule fired — all enriched with GeoIP.

Roughly: Wireshark is for decoding bytes inside packets. NetGeoAudit is for answering "who is connecting right now" and "why is this rule blocking".

Does it work on Windows Server?

Partially. Firewall and RDP monitoring — yes, actively tested on Server 2019/2022. DnsCacheService automatically falls back to polling ipconfig /displaydns on Server editions (ETW DNS events behave differently there).

Parts of the geo-audit are N/A: SIM MCC (no modem usually), Wi-Fi Country (no wireless adapter usually). The remaining scanners work the same as on desktop.

Server 2016 should work but isn't tested regularly. Server 2012 R2 is not supported — requires .NET 10, which doesn't install there.