FEATURES SCREENSHOTS DOWNLOAD FAQ CHANGELOG

TRUSTNOWIRE

Trust no wire -- including ours. Here's the proof.

REAL-TIME NETWORK MONITORING AND THREAT DETECTION FOR WINDOWS

EVERY CONNECTION EVERY PROCESS EVERY BYTE
DOWNLOAD v1.1.0
CAPABILITIES

FEATURES

LIVE CONNECTION TABLE

Every active TCP connection (IPv4 and IPv6) plus live UDP flows — QUIC and DNS included — with process name, remote IP, port, country, and Authenticode signature verification

PACKET CAPTURE

Real-time bandwidth monitoring via Npcap — IPv4, IPv6, and VLAN-tagged traffic — with per-connection byte counters and a live sparkline graph. Promiscuous mode is off by default and opt-in

DNS LOGGING

Intercepts and logs DNS queries with response IPs, TTLs, and the exact process that issued each query

THREAT SCORING

Automatic risk assessment based on process trust, port usage, traffic patterns, hosting provider reputation, and more

VIRUSTOTAL INTEGRATION

Auto-scan and manual scan of remote IPs against the VirusTotal database with your own API key

GEO-IP LOOKUP

Opt-in country, organization, and ASN resolution for remote IPs over HTTPS (ipinfo.io) — off by default, nothing leaves your machine until you enable it

WIDGET MODE

Win7-gadget-style micro dashboard showing live stats, bandwidth graph, and top threats at a glance

SYSTEM TRAY

Minimize to tray with tooltip, left-click restore, right-click menu

5 THEMES

Iron Man, Stealth, Cyberpunk, Light, Matrix -- each with matching glow effects

3 DISPLAY MODES

Compact, Normal, Expanded -- auto-resizes to fit your workflow

TOAST NOTIFICATIONS

Optional Windows toast alert the moment a new high-severity threat appears — trusted processes stay silent, and each threat only notifies once

CSV / JSON EXPORT

One click saves a snapshot of the full connection table and DNS log to your Downloads folder for offline analysis or evidence

INTERFACE

SCREENSHOTS

TrustNoWire Iron Man theme Expanded mode screenshot
GET STARTED

DOWNLOAD

v1.1.0
EXE SETUP MSI INSTALLER
Windows 10 or 11 (64-bit)
Npcap installed (free from npcap.com)
Administrator privileges
VIEW SOURCE ON GITHUB
INFORMATION

FAQ

ABOUT

TrustNoWire is built by LXB Studio LLC. This source code is public so you can verify exactly what it does on your machine. A network monitor you can't audit is a network monitor you shouldn't trust.
TrustNoWire is a real-time network monitoring and threat detection application for Windows. It watches every connection, every byte, and every process on your machine and shows you exactly what is happening. Built with Tauri 2 (Rust backend) and React, it runs as a lightweight desktop app with packet capture, DNS logging with per-query process attribution, threat scoring, and opt-in geo enrichment and VirusTotal integration.
Npcap is the Windows packet capture library that allows TrustNoWire to intercept and analyze raw network packets. It is required for bandwidth monitoring, DNS logging, and deep packet inspection. Download it free from npcap.com.
Create a free account at virustotal.com, copy your API key from your profile, and paste it in TrustNoWire Settings. Auto-scan is rate-limited to 4 requests per minute on the free tier.
TrustNoWire is source-available under the Business Source License 1.1. You can read, audit, and build the code for personal use. The license converts to MIT on 2030-02-09. See the full LICENSE.md in the GitHub repository.
Windows 10 or 11 (64-bit), Npcap installed (required for packet capture), and Administrator privileges for raw packet capture and full process visibility.
Only if you explicitly enable promiscuous capture in Settings — it is off by default. In the default mode TrustNoWire captures only traffic to and from your own machine. On a shared network segment (like open Wi-Fi), enabling promiscuous mode lets the adapter also see other devices' broadcast-domain traffic; the toggle discloses exactly that before you flip it.
Every installer is Authenticode code-signed by LXBSTUDIO LLC via Microsoft’s Azure Trusted Signing, and SHA-256 hashes for the current release are published on this page. Run Get-AuthenticodeSignature and Get-FileHash in PowerShell and compare against the published values — the full walkthrough is in the Installer Verification section.
VERSION HISTORY

CHANGELOG

v1.1.0
2026-07-20 -- THE "EVERY CONNECTION" RELEASE
UDP connection rows: live UDP flows observed on the wire — QUIC (UDP/443) and DNS (UDP/53) get their own protocol labels — attributed to the owning process via the OS socket table (IPv4 + IPv6)
IPv6 TCP connections now appear in the table — previously only IPv4 was queried
DNS process attribution: every DNS log entry shows which process issued the query, matched per-packet through the query’s source port — catches apps that bypass the system resolver
Windows toast notifications: optional alert when a new high-severity threat (score ≥ 60) appears; trusted processes are suppressed, each threat notifies once
CSV / JSON export: one click writes the connection table and DNS log to your Downloads folder
Promiscuous capture is now opt-in and off by default — the default capture sees only your own machine’s traffic, consistent with how geo lookup and VirusTotal already work
Event-driven UI: the backend pushes updates instead of the frontend polling; minimized-to-tray now pauses rendering entirely and resyncs on restore
Reverse-DNS lookups moved to a dedicated worker thread — a slow DNS server can no longer freeze the connection list
Single-instance guard: launching a second copy focuses the existing window instead of fighting over the capture handle
Fixed: 802.1Q VLAN-tagged frames were invisible to capture; tags are now unwrapped
Fixed: IPv6 packets with extension headers were dropped; the header chain is now walked to the transport layer
Fixed: ICMP / ICMPv6 and other non-TCP/UDP traffic now counts toward bandwidth totals
Fixed: malformed IPv4 packets with an illegal header length are rejected instead of misparsed
Threat flags for outbound-ratio are now mutually exclusive — one clear pill instead of two overlapping ones, same monotonic score
DNS log capacity raised from 500 to 5,000 entries; packet parsers now covered by unit tests
v1.0.1
2026-04-27 -- SECURITY & PRIVACY HARDENING
Authenticode code signing via Azure Trusted Signing — installer, MSI, and inner application all signed by LXBSTUDIO LLC; no more “publisher unknown” warning on first launch
Strict Content Security Policy enforced on the embedded WebView, hardening the in-app browser against any future UI exploit
Geo enrichment is now opt-in and off by default — no remote-IP data leaves your machine until you flip the toggle in Settings
Geo lookups switched from cleartext HTTP (ip-api.com) to HTTPS (ipinfo.io), with a built-in 30-day rate limiter
VirusTotal API key now persists across restarts; added a Clear button in Settings, and the key is never returned to the frontend
New “VT MALICIOUS” threat flag with engine detection count surfaced in the Why-flagged panel
External-link surface area scoped down: the in-app shell can only open the official LXB Studio site, nothing else
Fixed: per-connection bandwidth counters no longer drop bytes during the periodic refresh on busy connections
Fixed: threat score for high-outbound connections no longer double-counts the same condition
Fixed: IPv6 traffic now contributes to per-connection counters (previously skipped)
Fixed: in-memory caches (DNS, geo, VirusTotal results, process info) now bounded with LRU eviction — long sessions no longer leak memory
Expanded-view connection rows redesigned: cleaner column geometry, ellipsis on long hostnames and orgs, port number moved into the row header
No telemetry, no analytics, no auto-update channel — the only opt-in network calls are documented in the README’s new Privacy section
v1.0.0
2025-02-09 -- INITIAL RELEASE
Live connection table with process resolution, country lookup, and Authenticode verification
Real-time packet capture and bandwidth monitoring via Npcap
DNS query interception and logging with response IPs and TTLs
Automatic threat scoring with multi-factor risk assessment
VirusTotal integration (auto-scan and manual scan)
Geo-IP lookup via ip-api.com batch API
Win7-gadget-style widget mode (200x290)
System tray with minimize, restore, and quit
5 themes: Iron Man, Stealth, Cyberpunk, Light, Matrix
3 display modes: Compact, Normal, Expanded
Frameless transparent window with custom title bar
Admin elevation via UAC manifest in release builds
AUTHENTICITY

INSTALLER VERIFICATION

Authenticode-signed by LXB Studio LLC. Starting with v1.0.1, every TrustNoWire artifact — the installer, the MSI, and the application binary inside the installer — is code-signed via Microsoft’s Azure Trusted Signing service. Right-click any download → Properties → Digital Signatures to see the “LXBSTUDIO LLC” publisher entry and verify the chain back to a Microsoft Code Signing CA.

On first launch you should see a clean UAC prompt that lists LXBSTUDIO LLC as the verified publisher. If your build of Windows hasn’t cached our signing reputation yet, SmartScreen may still ask you to confirm — click More info → Run anyway. Reputation builds quickly across users; the signature itself is what matters.

🔒 SHA-256 hashes for v1.1.0. The Authenticode signature above is your primary proof of authenticity. These hashes are here as an extra reference if you’d like to confirm the bytes you have on disk match the bytes we shipped.

TrustNoWire_1.1.0_x64-setup.exe
ec73b15fdf162e2933bfbd6f34437b58a1b1fcc1d8613d4ca79dfe0ba3daa3ca
TrustNoWire_1.1.0_x64_en-US.msi
d9515ba3710cbceddf5af466198b71b12b8d00c3d5ded35a15c2881bb9a8d963

Step 1 — open PowerShell in the folder where you downloaded the installer. For most users that’s the Downloads folder, so paste this in any PowerShell window: 

cd $env:USERPROFILE\Downloads

Step 2 — verify the SHA-256 hash (use the line that matches your downloaded file): 

Get-FileHash TrustNoWire_1.1.0_x64-setup.exe
Get-FileHash TrustNoWire_1.1.0_x64_en-US.msi

The Hash column in the output must match the SHA-256 value shown above for that file exactly.

Step 3 — verify the Authenticode signature (do this for whichever artifact you plan to run): 

Get-AuthenticodeSignature TrustNoWire_1.1.0_x64-setup.exe | Format-List *
Get-AuthenticodeSignature TrustNoWire_1.1.0_x64_en-US.msi | Format-List *

You should see Status : Valid and a SignerCertificate.Subject that begins with CN=LXBSTUDIO LLC, issued by Microsoft ID Verified CS EOC CA 03. When both checks pass, you have the official LXBSTUDIO LLC release.