# I2PMon X ## I2P Network Management & Connection Intelligence ### Comprehensive User Guide **Version:** X **Application Type:** Standalone Desktop Utility **Platform:** Linux (Python Build / Standalone Binary) --- # Overview **I2PMon X** is a desktop network monitoring utility designed specifically for observing, managing, and understanding **I2P (Invisible Internet Project)** network activity. Rather than acting as a firewall or packet analyzer, I2PMon provides a clear operational view of connections occurring around an I2P router and related services. It collects connection information, classifies activity, maintains historical peer information, and allows the operator to monitor, redirect, or block individual peers while maintaining comprehensive JSON records for later analysis. The objective is simple: > Make anonymous networking understandable. I2PMon focuses on visibility rather than intrusion. It observes the system, interprets connection behavior, and presents information in an organized, searchable interface suitable for hobbyists, researchers, administrators, and privacy-conscious operators. --- # Features ## Live Network Monitoring Observe active I2P-related network connections in real time. Features include: * Continuous monitoring * Manual scan capability * Configurable scan interval * Connection history * Automatic peer discovery * Connection persistence * Historical JSON logging --- ## Connection Classification Each discovered connection is classified into an easily understood category. Typical classifications include: * I2P Likely * I2P Local * Listener * Unknown The classification engine relies on observable characteristics such as: * Network ports * Local services * Connection state * Process information * Known I2P routing ports Rather than guessing intent, I2PMon classifies only what it can directly observe. --- # User Interface The interface is divided into several operational sections. --- # Toolbar The toolbar provides quick access to all major application functions. ## Start Begins continuous monitoring. Once enabled, I2PMon repeatedly scans the system according to the configured scan interval. --- ## Stop Stops automatic monitoring. Monitoring may be restarted at any time without losing collected data. --- ## Scan Now Performs an immediate scan without enabling continuous monitoring. Useful when making configuration changes or performing troubleshooting. --- ## Export JSON Creates a complete JSON snapshot of the application's current state. The export includes: * Current configuration * Runtime state * Known peers * Active policies * Block list * Current connections * Historical events The exported file can later be archived, analyzed, or imported into external tools. --- ## Policies Displays all currently assigned peer actions. Each configured peer is listed together with its assigned policy. Examples include: * Observe * Redirect * Block --- ## Blocklist Displays all currently blocked IP addresses. This provides a quick overview of manually blocked systems. --- # Scan Interval Specifies how frequently automatic scans occur. The interval is measured in seconds. Example values: * 1 second * 5 seconds * 10 seconds * 30 seconds * 60 seconds Short intervals provide higher responsiveness while longer intervals reduce CPU usage. --- # Theme Switch I2PMon includes both: * Dark Mode * Light Mode The selected theme is automatically remembered between application launches. --- # Configuration Options ## Only I2P Limits displayed connections to those that appear to be related to I2P activity. When disabled, additional network activity may become visible. --- ## Auto Save Automatically records discovered connections into the event database. When disabled, monitoring continues but historical events are not written automatically. --- ## Kill Blocked When enabled, blocked connections may be terminated automatically if sufficient permissions exist. When disabled, block actions remain informational. --- # Connection Viewer The Connection Viewer displays active and recently observed connections. Columns include: ## Protocol Network protocol. Examples: * TCP * TCP6 * UDP --- ## Local Address Local IP address and port. Example: 127.0.0.1:7657 --- ## Remote Address Remote endpoint currently communicating with the system. --- ## State TCP state including: * LISTEN * ESTABLISHED * CLOSE_WAIT * TIME_WAIT * FIN_WAIT * SYN_SENT * SYN_RECV --- ## Process ID Operating system process identifier. Useful when tracing activity back to running software. --- ## Process Name Executable responsible for the connection. Examples: * java * ollama * firefox * ssh * python --- ## Classification Current connection classification. Typical examples: * I2P Likely * Listener * Unknown --- ## Assigned Action Current policy assigned to the peer. Examples: Observe Redirect Block --- ## Last Seen Timestamp indicating when the connection was last observed. --- # Filtering The filter box performs live searching across connection information. Filtering may be performed using: IP Address Process Name Connection State Classification Assigned Action Partial text matches Examples: ``` java ``` ``` 7657 ``` ``` ESTABLISHED ``` ``` listener ``` ``` block ``` Filtering updates immediately while typing. --- # Selected Peer Actions Each connection may be assigned one of three policies. --- ## Observe Default behavior. The connection continues to be monitored without intervention. --- ## Redirect Marks the peer as redirected. This serves as an operational policy indicator for future workflow or external processing. No network packets are modified. --- ## Block Adds the selected peer to the local block list. When Kill Blocked is enabled, matching processes may be terminated automatically. Otherwise, the block remains informational. --- # Peer Database Every observed peer is maintained within an internal JSON database. Stored information includes: IP Address First Seen Last Seen Connection Count Observed States Observed Ports Assigned Policy Blocked Status Notes The database grows naturally as additional systems are observed. --- # Peer History Each peer accumulates operational history over time. This allows identification of: Frequently observed peers Temporary peers Long-lived services Returning connections Repeated behaviors --- # Event Logging Every observed connection may be written to the event database. Logged information includes: Timestamp Protocol Addresses Ports Process Classification Action Notes The resulting JSON files are suitable for: Archiving Offline analysis Custom scripting Research Incident review --- # JSON Storage I2PMon maintains several JSON databases. Typical files include: Configuration Policies Peer Database Runtime State Block List Event History All files are stored in human-readable JSON format. No proprietary databases are used. --- # Process Identification Whenever possible, I2PMon identifies the owning process. This provides significantly more context than viewing ports alone. Examples include: I2P Router Address Book Java Ollama SSH Browsers Custom applications --- # Monitoring Philosophy I2PMon is intentionally passive. It does not: * Capture packets * Decrypt traffic * Modify I2P tunnels * Interfere with routing * Perform deep packet inspection Instead, it focuses on presenting operational information that already exists within the operating system in a concise, understandable format. --- # Typical Workflow 1. Launch I2PMon. 2. Select either Light or Dark Mode. 3. Configure the desired scan interval. 4. Enable Only I2P if focused monitoring is desired. 5. Press **Start**. 6. Observe active connections. 7. Filter connections when needed. 8. Select peers for Observe, Redirect, or Block. 9. Review Peer History. 10. Export a JSON snapshot when required. --- # Intended Uses I2PMon is well suited for: * I2P router monitoring * Anonymous networking research * Privacy laboratories * Network troubleshooting * Home server administration * Educational environments * Development testing * Connection auditing * Process verification * Historical network analysis --- # Performance The application is intentionally lightweight. It relies primarily upon operating system connection information and performs periodic scans rather than continuous packet capture. This minimizes CPU usage while still providing highly useful operational visibility. --- # Privacy I2PMon operates entirely on the local machine. No telemetry is transmitted. No analytics are collected. No cloud services are required. All collected information remains under the operator's control. --- # Summary I2PMon X transforms raw operating system connection data into an organized operational view of an I2P environment. Through continuous monitoring, intelligent classification, historical peer tracking, JSON logging, flexible filtering, and configurable connection policies, the application provides a practical platform for understanding anonymous networking without introducing unnecessary complexity. Whether used to observe a single desktop router or to monitor an active privacy research environment, I2PMon is designed to deliver clear, actionable visibility while remaining lightweight, transparent, and entirely under the operator's control.