Questions and answers.

It only watches; it does not block, slow down, or filter anything. For that, use Windows Defender Firewall or your router. It also cannot look inside one program to separate out code running within it. If something injects itself into a normal program, or runs through a Windows helper like rundll32 or regsvr32, its traffic shows up under that host program, because that is where the actual network connection lives. And when one shared svchost.exe process is running several Windows services at once, ZenVizor lists all of them and reports the process's total; it will not guess at how to split the bytes between them. Two kinds of traffic are left out by design: anything that no program on your machine actually owns, such as port scans or unsolicited attempts to reach a closed port (there is no program to credit it to), and ICMP traffic, including ping, which ZenVizor does not capture at all.

More than you might expect. Many browsers now look up websites over encrypted DNS, which skips the normal Windows lookup that older monitors rely on. ZenVizor handles this a second way: it reads the destination website name from the start of each connection (the unencrypted part of the handshake that names where you are going), so for most traffic, including modern QUIC connections to sites like YouTube, you still see real website names rather than bare IP addresses. It does this purely by observing, never by intercepting your data or sending anything itself. One narrow case still shows only an IP address: connections using the newest standard, Encrypted Client Hello (ECH), which hides even the website name. Reading it would mean actively probing the connection, and ZenVizor's first rule is to stay silent, so it does not. When this happens, the app tells you so right where the connection is shown.