Every connection in view, data collectors blocked.

Kestrel shows every connection your programs make, quietly blocks data collectors and asks only when it really matters.

macOS 13+
Windows 11· in preparation
Linux (.deb)· in preparation

The main window of Kestrel: the areas on the left, the connections of all programs with country, received and sent data in the middle, and the details of Safari with its rules on the right.

Block data collectors

Data collectors are blocked before they send anything.

Kestrel quietly blocks trackers, advertising and vendor telemetry without asking. The lists come from HaGeZi and are fetched straight from the source once a day. You choose how strict Kestrel is with the levels Normal, Strict and Hardcore.

domains in Hardcore: 786,000
check time per connection, measured: 0.1 µs
levels: Normal, Strict, Hardcore: 3

The data collector overview: 876 connections blocked today, the levels Off, Normal, Strict and Hardcore, the DNS filter and a table of which program tried to reach which data collector.

See every connection

You see which program connects where.

Kestrel lists every connection by program, with destination, country and the data received and sent. You switch between list, map and columns. The details name the host, address, operator, signature and the rule that currently applies.

The connections in columns: the programs on the left, the destinations of the selected program in the middle, details and rules on the right.

Prompts that don’t nag

Kestrel asks rarely and explains in plain words what it is about.

Programs from Apple run without a question. Kestrel asks about a validly signed program once; after you allow it, its further destinations pass without asking. Only programs without a valid signature are asked about for every new destination. The prompt names who runs the server and who signed the program.

On macOS, prompts need the system extension, which comes with the signed build. Until then Kestrel watches every connection and blocks data collectors through its DNS filter.

A prompt for Godot: program, map, address, operator and signature on the left; on the right the choice of what the answer applies to and for how long, with the buttons Block and Allow.

World mapPro

The map shows which countries your data goes to.

Arcs lead from your location to every active destination, coloured by allowed, blocked and asking. A click on a dot selects the connection. The location data lives inside the app, so no address leaves your computer.

The world map above the list of connections, with arcs from Germany to destinations in Europe and North America.

Profiles per networkPro

Each network has its own set of rules.

You create profiles such as Home, On the go or Public Wi-Fi and assign networks to them. Kestrel switches the profile by itself as soon as you join one of these networks. Each rule applies to all profiles or to just one.

The profiles: the current network with Wi-Fi name and gateway, the profiles Home and On the go, and the assignments of networks to profiles.

Doesn’t work any more?

When a program stops working, Kestrel shows why.

“Doesn’t work any more?” lists what Kestrel blocked for a program in the last minutes and names the list or rule behind it. One click allows a single destination. If that is not enough, a pause lets everything through for five minutes, after which everything is as before.