Visibility • Control • Insight

I2PMon X

A focused desktop utility for observing, classifying, filtering, documenting, and managing I2P-related network connections without turning the operator’s desktop into a packet-analysis laboratory.

Download I2PMon X Explore Functions

PlatformStandalone Linux desktop utility

Primary RoleI2P connection monitoring and management

DataHuman-readable JSON logs and exports

PrivacyLocal operation with no telemetry

Application Overview

Understand the network around your I2P router.

I2PMon X is a professional desktop utility designed to transform raw operating-system connection information into a structured operational view of an I2P environment. It watches network activity associated with the I2P stack, records peer behavior, identifies processes and ports, tracks connection history, supports manual peer actions, and produces comprehensive JSON exports suitable for documentation, troubleshooting, research, or later analysis.

The application is intentionally narrower than a packet analyzer and more informative than a simple connection list. It does not attempt to decrypt traffic, inspect packet payloads, or interfere with tunnel construction. Its value lies in making observable facts easier to interpret: which process owns a connection, when it appeared, how long it remained active, which ports were used, whether the peer returned, what classification applies, and what policy the operator assigned.

I2PMon X is built for users who need practical visibility into anonymous networking without abandoning the privacy principles that make I2P useful.

Operational Preview

Purpose & User Types

Built for observation, security, research, and education.

I2P Operators

Monitor the local router, address book activity, listeners, persistent peers, tunnel-adjacent services, and recurring connection patterns.

Privacy Users

See what is active around a privacy-focused workstation without relying on vague assumptions or oversized enterprise dashboards.

Security Researchers

Document process-linked connections, evaluate repeated behavior, isolate unknown activity, and export evidence in structured JSON.

System Administrators

Track listeners, identify owning processes, inspect peer histories, add notes, and distinguish expected services from unexplained activity.

Developers & Testers

Observe application behavior while developing I2P-aware software, testing tunnel configurations, or validating service deployment.

Students & Educators

Use a readable visual interface to study TCP states, listeners, local services, processes, anonymous networking, and connection lifecycles.

General & Security Applications

Operational uses without pretending every connection is a threat.

Live AwarenessObserve current and recently active I2P-related network connections, listener states, processes, ports, and peer activity.

TroubleshootingDetermine whether a service is listening, whether a peer is returning, whether a process owns the expected port, and whether the router is actively communicating.

Security ReviewIdentify unknown processes, unexpected ports, unusual persistence, repeated reconnections, or peers that warrant further investigation.

Policy ManagementAssign Observe, Redirect, or Block policies to peers and maintain a persistent local record of those choices.

Historical AnalysisTrack first seen, last seen, hit counts, ports, states, reconnects, duration, notes, and resolved names over time.

EducationDemonstrate how network connections, TCP states, listeners, ports, processes, and anonymous routing components appear at the host level.

Core Functions

Application capabilities at a glance.

▶

Real-Time Monitoring

Start, stop, and manually trigger connection scans with a configurable interval.

⌁

Connection Intelligence

View protocol, endpoints, state, PID, process, classification, action, lifetime, and recurrence.

⌕

Focused Filtering

Filter by free text, process, state, class, action, port, address, or other visible connection fields.

◎

Peer History

Inspect first seen, last seen, hit counts, observed ports, observed states, notes, and policy status.

⇣

Kitchen Sink Export

Export configuration, runtime state, peers, policies, blocklist, connections, history, statistics, and events in one JSON file.

◐

Light & Dark Themes

Choose the interface that works for the room, display, time of day, and operator preference.

Comprehensive User Guide

Functions, options, controls, and workflow.

Monitoring controls and monitor status

Start

Begins continuous monitoring. I2PMon scans at the configured interval and updates connection, peer, history, and statistics data.

Stop

Stops automatic scanning while preserving the records already collected during the current run.

Scan Now

Runs an immediate one-time scan. This is useful when validating a service change, checking a newly started process, or refreshing the display without enabling continuous monitoring.

Scan Interval

Controls how many seconds pass between automatic scans. Short intervals provide more immediate visibility. Longer intervals reduce repeated system queries and disk writes.

Status indicators

The application reports whether monitoring is active, stopped, waiting, or completing a scan. The statistics area summarizes active connections, listeners, established sessions, unique peers, blocked peers, redirected peers, and logged events.

Selection boxes, dropdowns, and theme controls

Only I2P

Restricts the visible and recorded connection list to activity that matches known I2P ports, processes, or relevant behaviors.

Auto Save

Controls whether discovered connection events are automatically written to the event log.

Kill Blocked

Allows the application to terminate a matching locally owned process when a blocked connection can be tied to a PID. This option should be used carefully because terminating a process can affect more than one connection.

Theme dropdown

Switches between Light and Dark themes. The selected theme is stored in the configuration and restored when the application launches again.

Action dropdown

Assigns one of the available policies to the selected peer: Observe, Redirect, or Block.

Filter dropdowns

Filter the connection table by state, process, classification, or action. These controls can be combined with the text filter to narrow the display quickly.

Connection table and sorting

The main table presents connection information in sortable columns. Depending on the current build, available fields may include:

Protocol
Local IP address and port
Remote IP address and port
Resolved host or service name
Connection state
Process ID
Process name and description
Classification
Assigned action
First seen and last seen
Connection duration
Reconnect or observation count

Clicking a column heading sorts the current records by that field.

Filtering and search

The text filter searches across visible connection information. Typical searches include:

java for I2P-related Java processes
7657 for the router console port
ESTABLISHED for active sessions
listener for listening services
block for blocked policies
An IP address, process description, or resolved name

The dropdown filters may be used independently or combined with the text filter. Clear restores the unfiltered view.

Observe, Redirect, and Block policies

Observe

The default policy. The peer remains visible and continues to accumulate history without intervention.

Redirect

Marks the peer for alternate handling in the application’s policy records. Redirect is a management label and does not silently reroute or hijack traffic.

Block

Adds the peer address to the persistent blocklist. When Kill Blocked is disabled, the policy remains informational. When enabled and a PID is available, the application may attempt to terminate the owning process.

Blocking an IP address inside I2PMon does not automatically create a permanent operating-system firewall rule.

Peer history, notes, and name resolution

Each observed peer accumulates a persistent history including first seen, last seen, hit count, observed states, ports, policy, blocked status, notes, and resolved host name when available.

Manual reverse-name resolution

Where supported, the operator can request a reverse DNS lookup for a selected address. Manual resolution avoids slowing every scan and prevents unnecessary DNS traffic.

Notes

Notes allow documentation of known peers, research findings, normal behavior, follow-up tasks, or reasons for a block or redirect policy.

JSON logging and “The Kitchen Sink” export

The complete export captures application metadata, configuration, theme, monitoring options, runtime state, statistics, peers, peer history, notes, resolved names, policies, blocklist, current connections, lifetime data, reconnect information, and historical event records.

The resulting JSON can be archived, searched, compared between sessions, processed with scripts, imported into analytical tools, or retained as part of an incident or research record.

Light and Dark themes

Dark mode is designed for low-light operational environments and long monitoring sessions. Light mode improves readability in daylight, bright rooms, and high-glare displays. Theme switching does not affect monitoring or saved data.

Recommended operating workflow

Launch I2PMon X.
Select Light or Dark mode.
Set an appropriate scan interval.
Enable Only I2P for focused monitoring.
Enable Auto Save when historical records are required.
Press Start and allow the application to establish a baseline.
Use filters to inspect processes, ports, states, peers, or classifications.
Open peer details for history and notes.
Assign Observe, Redirect, or Block policies only when justified.
Export a complete JSON snapshot when documenting a session or important event.

Security & Privacy Position

Observation without surveillance theater.

I2PMon X operates locally and is intended to improve the operator’s visibility into their own system. It does not capture packet payloads, decrypt I2P traffic, inspect private content, transmit telemetry, require a cloud account, or report usage to an external service.

The application is an operational connection monitor and management aid, not a complete firewall, intrusion-detection platform, or forensic packet-analysis suite. Classifications are based on observable host information such as ports, processes, connection states, and known I2P patterns.

Binary Release

Download I2PMon X.

I2PMon_latest.zipStandalone application package. Binary release only.

Download Latest

Disclaimer & License Notice

Use responsibly and verify your environment.

General disclaimer

I2PMon X is provided as an informational, educational, administrative, and research utility. Network information may be incomplete, delayed, misclassified, altered by operating-system permissions, or affected by differences in system tools and platform behavior. Operators should verify important findings with appropriate system utilities and professional judgment.

The application does not guarantee security, anonymity, privacy, threat prevention, connection blocking, or uninterrupted operation. Use of I2PMon does not replace secure configuration, operating-system updates, firewall management, access controls, logging policy, or incident-response procedures.

Authorization and lawful use

Use I2PMon only on systems and networks you own, administer, or are explicitly authorized to inspect. The operator is responsible for complying with applicable laws, organizational policies, privacy obligations, and network-use agreements.

Software license notice

Unless a separate license file accompanies the distributed package, the software remains the intellectual property of its author and is provided for personal, educational, administrative, and authorized research use. Redistribution, modification, commercial packaging, or representation as another party’s work requires the author’s permission.

The software is provided “as is,” without warranties of merchantability, fitness for a particular purpose, security, accuracy, or non-infringement. The author is not responsible for data loss, service interruption, process termination, blocked connections, misinterpretation of network information, or other damages arising from use of the application.