The Traffic Monitor
A live, minimalist log of what MSL and an instance are doing — and what Linux has connected.
The Traffic Monitor is a small, live view of what's happening between your Mac and an instance. Open it from the Watch card on the Sandbox tab — Open, or ⇧⌘T while the Sandbox tab is showing. It slides down over the window; Done closes it.
Along the top: Pause/Resume (freezes the list so you can read it), Clear (empties the log), and Done. Under that, two lanes.
MSL activity#
MSL's own traffic: the things your Mac and the instance actually say to each other through MSL. Newest at the top, each with the time, a coloured icon and a short summary. Repeated events fold together with a count like ×12 instead of flooding the list.
| Category | Colour | Covers |
|---|---|---|
| Control | blue | Commands to the background service: start, suspend, snapshot. |
| Files | green | The file bridge — MSL Files and Finder reading and writing guest files. |
| Display | purple | X11 connections, app windows, mslgd. |
| Lifecycle | orange | The virtual machine itself: booted, paused, restored, stopped. |
| Sandbox | red | Gates opening and closing. |
Click a category's chip to hide or show it. This instance only (on by default) hides other instances' events — MSL-wide events, like the service starting, always show because they're context.
With nothing to show yet it says "Listening…" — start the instance, open a file or launch an app and it'll appear. The footer counts what's shown.
Guest connections#
What Linux itself has open, read from Linux's own network stack once a second:
- Each row: TCP or UDP, then either "listening on address:port" or local → remote, the program that owns it, and its state (listening ones in green).
- Show processes matches each connection to the program that owns it. That means looking through every open file of every program in Linux, so it's only done while you're looking.
- Hide loopback (on by default) hides connections that never leave the guest, and says how many it hid.
This lane reports sockets, not packets: that something is connected to an address, and who owns it — not what was sent.