The feed

The feed is the dashboard's main screen — a live, Proxyman-style stream of every request/response pair from every device you can see. New rows land at the top the moment they happen, pushed over Realtime with no polling.

The left panels

Two stacked rails sit to the left of the feed and scope what it shows:

• Devices — one row per device with an online dot, connection mode (VPN / PAC / OFF), country flag(s), a request count, and "last seen". Click a device to scope the feed to it; click again to clear. A gear opens that device's settings.
• Services & Domains — your service groups (the analogue of Proxyman's "Apps") stacked above the live per-host Domains list. Each section has its own filter and sort in its header; click a service or a domain to scope the feed to it.

Selecting a device here scopes the feed and every counter to that device, so the numbers always match what you're looking at.

Reading rows

The feed has two densities, set in the toolbar's View options popover and saved per tab:

• Comfortable (2-line) — a flat list where each row leads with a color-coded status dot, then the host/path, with the method and protocol type on the trailing edge, and a second line of device / size / duration / id / time.
• Compact (1-line) — turns the feed into a column table (below).

Decrypted HTTPS requests appear as their own top-level rows; an encrypted or still-active CONNECT tunnel shows as a single row until its decrypted requests take over.

The column table (1-line mode)

In compact mode the feed becomes a data grid where the sticky header and every row share one column layout, so cells stay aligned. The full column set is:

Status · ID · Method · Type · URL · Device · Country · Conn · Proxy · Size · Duration · Time

• Status renders as a color-coded dot — green for 2xx, amber for 3xx, red for 4xx, purple for 5xx, and a soft-pulsing amber for an in-flight row with no response yet. Its header carries no text.
• ID is the entry's stable request number (the #5821 you can quote in chat or notes).
• Method is the HTTP verb; Type is the protocol/content bucket.
• URL is the flexible column — it stretches to fill until you drag-resize it.
• Device · Country · Conn · Proxy describe where the request came from: the device name, its real country, its connection type, and its outbound proxy country.
• Size is the response size; Duration is humanized (240ms, 2.4s, 1m 12s, 3h 5m, 2d 4h); Time is when it landed.

The mobile-friendly default hides the wider columns, leaving Status · ID · Method · URL · Time. Show or hide any column from the Columns section of View options, or by right-clicking a header cell.

Sorting, resizing, reordering

• Sort — click a sortable column's header cell to sort the whole dataset server-side. Each click cycles descending → ascending → off; clearing returns to the live newest-first stream, and a chevron marks the active column. Sortable columns are Status, ID, Method, Size, Duration, Time plus the four device-attribute columns (Device, Country, Conn, Proxy). URL and Type aren't index-backed, so their headers don't sort.
• Resize — drag any column's right edge (including URL, which switches from flexible to a fixed width once dragged).
• Reorder — drag a column header to a new position, or drag the column chips in View options; the two stay in sync.

Column widths, order, the hidden set, and the active sort all persist per tab.

Tip: When exactly one domain is selected, rows drop the redundant host prefix and show just the relative path — freeing width for the part that varies.

Status dots at a glance

In color: green 2xx, amber 3xx, red 4xx, purple 5xx, and a pulsing amber ring for a request still awaiting its response.

Searching across all history

The search box in the feed toolbar matches the host, path, and URL server-side over a trigram index, so it finds matches anywhere in your history — not just the rows already loaded in the browser. Both the result list and the X of N count are computed server-side, so the denominator reads the true filtered total.

Under the hood, the result list is served by the entries_filtered_list RPC with keyset (cursor) pagination, and the count by entries_filtered_count — which is why the feed stays fast even over hundreds of thousands of rows.

Filtering

Open the Filter popover (a dot on the icon means a filter is narrowing the feed). All chip filters are multi-select — chips within a group are OR'd, groups are AND'd, and everything persists per tab:

• Method — GET POST PUT DELETE PATCH HEAD OPTIONS.
• Status — 2xx 3xx 4xx 5xx (plus active).
• Source — Live vs History.
• Content-type — DevTools-style buckets (json, html, js, css, image, font, media, xml, text, other).
• Inspection (TLS) — Decrypted only / Encrypted only / SSL Pinned only.
• Resent — replayed requests vs originals (see Breakpoints & resend).
• Service groups and Tags — filter by an applied service or colored tag.

Advanced rules live behind their own popover: each rule is include or exclude over a field (Host, Path, URL, Method, Status, request/response header or body) with an operator (contains, equals, matches regex, and their negations).

Counts

The search bar shows X of N — X visible rows of N server-side matches for the current filter and scope — followed by (L new · H loaded) for the live-arrived vs history-loaded split. A trailing + on N means the server hit its scan cap and the true total is higher.

The detail panel

Click any row to open it in the detail panel. It can dock to the right of the feed or along the bottom (a toggle in the feed toolbar, desktop only); both placements are resizable. On phones and tablets the panel takes over the screen with a Back button. See Inspect requests & HAR for what's inside.

Pinning

Right-click a device, service, domain, or entry to Pin it. Pinned items float to the top of their list for quick access, and pins persist across reloads.

Tip: Save a filtered view you return to often as a workspace tab — the whole layout, filters, and sort come back when you switch to it.