PacketHound went up on Hacker News over the weekend as "A Little Snitch for Windows" and reached 113 points. It's free, GPL-3.0, and shows an Allow/Block prompt the first time any app tries to reach the internet. I read its source. By design, it won't show you most of what Windows 11 itself sends home. Windows telemetry gets allowed without a prompt.
That's deliberate, and I think it's the right default. You should still know about it before you trust the tool to tell you "what your PC sends out". Below I compare PacketHound with Portmaster, simplewall, Fort, Windows Firewall Control and GlassWire, list what Windows 11 actually contacts, and show how to run deny-by-default outbound without breaking Windows Update.
What PacketHound actually is
Mac users have had Little Snitch for over 20 years. Windows users who search "little snitch for windows" have mostly ended up in wf.msc building rules by hand.
PacketHound adds no kernel driver and runs no service of its own. It's a C# app that does four things:
- Sets Windows Firewall's default outbound action to Block.
- Turns on failure auditing for the "Filtering Platform Connection" subcategory via
auditpol. - Watches the Security log for event 5157 ("The Windows Filtering Platform has blocked a connection"). You can see this in
ConnectionMonitor.cs. - Prompts you and writes your answer as an ordinary Windows Firewall rule.
Step 4 is the best part of the design. Every decision is a normal rule you can see in wf.msc, rules keep working when PacketHound isn't running, and uninstalling it puts the firewall back the way it was.
Step 3 is where it pays for that simplicity: the prompt only appears after the connection has been dropped. The site says so plainly: "PacketHound learns about an app because its connection was blocked, so after you click Allow the app has to try again." On HN, LoganDark made the same point about Windows Firewall Control, which "only prompts you after the connection has already been rejected", while Little Snitch and Portmaster hold the connection until you answer. Installers that give up after one failed attempt are why v1.2.0 added a notification that pauses protection for 5 minutes in one click after you allow an installer.
The project is also very new. The GitHub repo was created on 5 November 2026. Versions 1.0.0, 1.1.0 and 1.2.0 all shipped between 5 and 6 November, according to the changelog. The site doesn't name a developer. Several HN commenters also didn't like the LLM-flavoured landing page; one wrote, "I'd rather not use a security tool which is 100% vibeslop with a 100% vibeslop website." The code is short and readable, so I'd judge it by the code.
Why it won't show you Windows phoning home
This is from WindowsAppClassifier.cs. A program is allowed silently, with no prompt, if all three of these are true:
- it lives under
%SystemRoot%,Program Files\Windows *or the Defender folders - its file is owned by TrustedInstaller or SYSTEM
- it has a valid Microsoft Windows Authenticode signature
svchost.exe passes all three. Windows telemetry comes from the Connected User Experiences and Telemetry service (DiagTrack), which runs inside svchost.exe. So does Windows Update. PacketHound therefore allows both without asking. The author did think about abuse: powershell.exe, curl.exe, certutil.exe, mshta.exe, rundll32.exe, bitsadmin.exe and 26 other living-off-the-land binaries (32 names in total, matched by filename) still trigger a prompt. Store apps from Microsoft's own publisher IDs are treated as part of Windows by default; third-party Store apps are not.
This trade-off makes sense for a tool that ordinary people will keep installed past the first week, because prompt fatigue is what kills these tools. On HN, dikei said "alarm fatigue became a major issue" and went back to the stock firewall. If what you want to watch is Windows itself, though, you need something extra (see below).
What Windows 11 phones home to
Microsoft publishes the list. For its Windows 11 Enterprise endpoint page (updated 16 June 2026), Microsoft left a default install idle for a week and logged all egress traffic. The rows I care about:
| What | Endpoint |
|---|---|
| Telemetry (DiagTrack) |
v10.events.data.microsoft.com, self.events.data.microsoft.com
|
| Error reporting |
watson.*.microsoft.com, telecommand.telemetry.microsoft.com
|
| Spotlight, tips, "suggested apps" |
arc.msn.com, api.msn.com, ris.api.iris.microsoft.com
|
| Cortana and Live Tiles (Bing, widgets) |
www.bing.com, widgetservice.azurefd.net
|
| Defender cloud protection | wdcp.microsoft.com |
| Windows Update |
*.update.microsoft.com, *.delivery.mp.microsoft.com, *.windowsupdate.com
|
| Connectivity check | www.msftconnecttest.com |
According to Microsoft, if you block Update you lose patches, and if you block ctldl.windowsupdate.com root certificates stop updating. Leave those two alone. The telemetry and Spotlight rows are the reasonable ones to cut.
PacketHound vs Portmaster vs simplewall vs the rest
| Tool | Price | License | How it filters | Prompt timing |
|---|---|---|---|---|
| PacketHound 1.2.0 | Free | GPL-3.0 | Windows Firewall rules + event 5157 | After the first attempt is blocked |
| Windows Firewall Control 6.38.0.0 | Free | Closed | Windows Firewall rules, notifications for blocked outbound | After block |
| Portmaster 2.2.8 | Free; Plus €40/yr; Pro €8/mo or €80/yr | GPL-3.0 | Its own engine | Holds the connection (per HN) |
| simplewall v.3.8.7 | Free | GPL-3.0 | WFP filters | Notification after a packet is dropped |
| Fort Firewall v3.20.9 | Free | GPL-3.0 | Own driver, independent of Windows Firewall | "Ask to Connect" mode pauses the connection |
| GlassWire | Free tier; Premium from $2.99/mo | Closed | Own firewall UI | "Ask to Connect" is Premium only |
My takes:
- Windows Firewall Control uses the same model as PacketHound and has been around for years. One HN commenter called it "the real Little Snitch for Windows." PacketHound's additions are open source code and a much quieter default for Windows components.
- Portmaster is the closest you'll get to real Little Snitch behaviour on Windows, with Fort as the other option that holds connections. One HN commenter quit it after existing features went behind a subscription, but the pricing page says local privacy features stay free.
- simplewall's last stable release was August 2025. One HN user reports that it re-prompts whenever an app's checksum changes, which is miserable with auto-updating apps and with a coding agent that keeps recompiling an exe.
- Fort is GPL-3.0 too and came up in the thread, with a link to its wiki page on HVCI (memory integrity). Fort runs its own driver, and its README lists turning memory integrity off as a system requirement. In return you get an "Ask to Connect" mode that pauses the connection while you decide. It's actively maintained; v3.20.9 shipped on 7 November 2026.
- GlassWire puts the one feature this article is about behind a subscription. Skip it.
Deny-by-default outbound without breaking updates
If you only want to see what happens, PacketHound or WFC will do the setup for you. Here is what they automate, in case you want to do it yourself. Run these in an elevated PowerShell:
# 1. Log blocked connections (event 5157)
auditpol /set /subcategory:"Filtering Platform Connection" /failure:enable
# 2. Flip outbound to deny-by-default
Set-NetFirewallProfile -All -DefaultOutboundAction Block
# 3. See who got blocked
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5157} -MaxEvents 50 |
Select-Object TimeCreated, @{n='App';e={$_.Properties[1].Value}}, @{n='Dest';e={$_.Properties[5].Value}}
Step 2 will break Windows Update, Defender's cloud lookups and nearly every app until you add allow rules (the built-in Core Networking rules keep DNS and DHCP alive). That's exactly the work PacketHound's classifier does for you. If you go the manual route, allow by service instead of opening up all of svchost.exe:
foreach ($svc in 'Dnscache','wuauserv','BITS','DoSvc','CryptSvc') {
New-NetFirewallRule -DisplayName "Allow $svc" -Direction Outbound -Service $svc -Action Allow
}
Next, block telemetry explicitly. Windows Firewall gives block rules priority over allow rules, so this works even if PacketHound or anything else has already allowed svchost.exe:
New-NetFirewallRule -DisplayName "Block DiagTrack" -Direction Outbound -Service DiagTrack -Action Block
Also go to Settings › Privacy & security › Diagnostics & feedback and turn off optional diagnostic data. Of everything here, that setting is the change least likely to break something.
To undo the whole thing:
Set-NetFirewallProfile -All -DefaultOutboundAction Allow
auditpol /set /subcategory:"Filtering Platform Connection" /failure:disable
Don't skip the auditpol line. If you leave auditing on, every dropped packet keeps writing a 5157 event to your Security log.
Should you install it
If you want per-app outbound prompts on Windows with no driver, no subscription and rules you can inspect in wf.msc, PacketHound is a reasonable choice, as long as you're comfortable running a three-release-old project from an anonymous developer. If you want connections held until you answer, the way Little Snitch does it, use Portmaster, or Fort if you can live with memory integrity turned off. Whichever you pick, add the DiagTrack block rule, because none of the friendly defaults will do it for you.
What's the most surprising app you've caught phoning home from your machine? And does anyone still think prompt-based firewalls are worth the alarm fatigue?
Top comments (0)