100% Free Public beta available

Windows network security and traffic monitoring.

CustosXI is a free, local-first network security and monitoring tool for Windows. Monitor network traffic, DNS queries, connections, firewall events and security signals directly on your PC. Investigate suspicious activity, detect anomalies and control unwanted network communication.

Download free Why CustosXI

Monitor. Analyze. Detect. Control.

CustosXI is built for people who want visibility without giving up control of their network telemetry.

NET

Network traffic visibility

See network communications, applications, hosts, and destinations directly on your Windows PC. Analysis runs locally by default and network telemetry is not uploaded to CustosXI servers.

DNS

DNS-level protection

See DNS queries in context and block domains that are useless, invasive, or risky - before they turn into full connections.

Local AI anomaly detection

On-device Isolation Forest and statistical baselines flag unusual traffic - no cloud LLM, no external model API. Tune it in Settings → AI / Anomaly.

Public blacklists

Import and refresh community threat feeds (IPs and CIDR ranges). Match traffic against known-bad sources locally - you choose which feeds to enable in Settings.

AGG

DNS sinkhole aggressive mode

When the sinkhole blocks a domain, CustosXI resolves its real IPs via upstream DNS and applies temporary Windows Firewall blocks on those addresses. Block duration escalates if the same IP keeps appearing within a configurable window. Requires sinkhole on - Settings → DNS.

DATA

Less wasted bandwidth

Cut trackers, ads, telemetry, and low-value background calls. Useful on metered links, mobile hotspots, and everyday Windows use.

Want the full story behind the project? Read about CustosXI.

Free to download and use

CustosXI is freeware: no paywall, no hidden premium tier, and donations are optional. Optional add-ons (GeoIP, Suricata, reputation APIs, and more) are under your control in Settings → Add-on.

See CustosXI in action

Screenshots from the Windows app: traffic, risk signals, firewall, entities, and more - all analyzed locally on your PC.

Click any screenshot to view it full size.

CustosXI Windows network monitoring overview — **Overview**High-level network activity at a glance.

CustosXI live network traffic monitoring — **Live traffic**Real-time connections and flows.

CustosXI network entity details with IP and risk information — **Entity details**Drill into hosts, IPs, and related events.

CustosXI network security signals and risk analysis — **Signals**Risk and behavior signals for investigation.

CustosXI local AI network anomaly detection — **AI anomaly**Anomaly detection and AI-assisted investigation signals.

CustosXI Windows firewall events and network activity — **Firewall events**Windows firewall activity in context.

CustosXI chronological network event timeline — **Timeline**Chronological view of network events.

CustosXI network traffic correlated with autonomous systems and ASN data — **ASN**Correlate traffic with autonomous systems.

CustosXI geographic breakdown of external network communication — **Country**Geographic breakdown of external communication.

CustosXI top network security risks and risk prioritization — **Top risk**Prioritize the most relevant risk items.

CustosXI unique external IP addresses and network destinations — **Unique IPs**External destinations seen on the system.

CustosXI traceroute and network path analysis for remote endpoints — **Traceroute**Path visibility for remote endpoints.

CustosXI public threat blacklist and IP reputation data — **Public blacklist**Feed-based reputation context.

CustosXI Log Center with searchable network and security logs — **Log Center**Browse JSONL logs, filter by level, search, and live tail.

CustosXI local database storage and network data retention settings — **Database settings**Local storage and retention options.

Local visibility, no magic promises.

CustosXI gives you direct visibility into network activity on your Windows PC. It combines traffic, DNS, firewall, reputation and anomaly signals to help you understand what is happening and investigate potential risks.

NET

Traffic & connections

View communications, hosts, ports, external IPs, and signals useful for local analysis.

DNS

DNS & destinations

Read DNS queries, remote destinations, and context about what your system talks to.

ASN

ASN & risk

Correlate external IPs and autonomous networks to highlight interesting or suspicious traffic.

Firewall events

Bring firewall events into a clearer view linked to the rest of your telemetry.

IDS

Optional Suricata

Display Suricata EVE JSON alerts in a local Windows dashboard.

LOC

Local-first

Focused on local analysis and transparency about components, privileges, and requirements.

Legal & transparency

CustosXI is free freeware. Privacy, terms, security disclosure, and third-party notices are published openly.

Privacy

Website vs app - local-first, no automatic upload of traffic to our servers.

Terms

Beta software, acceptable use, no warranty, not a full security suite.

License

Freeware - free personal/lab use; no redistribution without permission.

Security

Safe downloads and security@custosxi.com for reports.

Third-party

Open-source libraries and optional add-ons - thank you to all contributors.

Legal

Project owner, Italy, official contacts.

Free download Latest Beta

Download the beta

Official Windows installer. Bundles CustosXI, .NET 10, and required runtimes. Many features are still maturing - see About for AI and beta scope. Npcap, Suricata, PostgreSQL, and GeoLite2 are not included - install or configure separately.