Identifies apps and services without decrypting your content.
FlowSense's engine, fs-dpi, reads each connection's handshake.
4× as many as on 1 October, when there were 397. Counted on 27 October 2026.
State machines follow each connection's first packets. Same traffic, same answer, every time.
A hostname trie, an Aho-Corasick scan for payload patterns, and multi-packet programs that step through a connection's opening packets in both directions. Correlation tables carry what one connection reveals, such as a DNS answer, a TLS fingerprint or a call's media server, to the next.
Warden's model judges each new connection on your Mac: ads, trackers, telemetry, scans.
It reads the engine's labels for the connection and decides whether it needs you. It's a Research Preview: we recommend Ask mode, and its confidence score is not a measure of accuracy. It never decides to slow traffic.
The engine and Live are free. Warden, rules and block lists need FlowSense Full.
Download