NetClamp docs

Known limits

A few cases worth knowing before you spend time debugging.

ICMP traffic (ping, tracert) isn’t per-app

A BLOCK rule on ping.exe will save successfully but ping will keep working. Same for tracert and PowerShell’s Test-NetConnection.

These tools don’t have their own network sockets — they ask Windows itself to send the packets, so Windows is technically the sender, not the calling tool. App-level rules can’t catch what Windows doesn’t attribute to an app.

Workaround: to block ICMP, use a Windows Firewall rule (it filters at the packet level where this doesn’t matter). This is the same boundary every per-app firewall on Windows runs into.

Loopback traffic isn’t shaped

Rules don’t affect traffic between your own machine’s localhost endpoints (127.0.0.1, ::1). This is intentional — clamping loopback would slow down NetClamp’s own UI talking to its service, local test scripts, etc.

If you’re measuring rate-limit accuracy, use a real public target (e.g. a speed-test endpoint or any HTTPS download).

Multiple per-app firewalls may interfere

If you have another per-app firewall (NetLimiter, a VPN with a kill switch, etc.) installed alongside NetClamp, Windows evaluates everyone’s rules. Conflicting rules across products may produce surprising outcomes — e.g. NetClamp BLOCK paired with another product’s ALLOW on the same flow can let traffic through.

The Dashboard’s competing shapers field surfaces any well-known ones we detect.

Microsoft Store apps need their own match mode

Store apps live in sandboxed paths that change between Store updates. A rule using App by path on a Store app’s .exe will silently stop matching after a Store update.

Always use the Microsoft Store App match mode for Store apps — that matches by the app’s package identity, which is stable across updates.

Quotas use exact clock boundaries

Window resets happen on the system clock:

  • Hourly quotas reset at :00.

  • Daily quotas reset at local midnight.

  • Weekly quotas reset Monday 00:00 local.

  • Monthly quotas reset on the 1st at 00:00 local.

If you’re streaming exactly when a window rolls over, a kilobyte or two of traffic may land on either side of the boundary. Worth knowing if you’re building dashboards on top of the counters; matters for no other practical use.

Dashboard totals reset when the service restarts

The Upload / Download / Connections totals on the Dashboard are since-boot counters. They go back to zero when the NetClamp service restarts (planned or otherwise).

Quotas don’t reset on restart — they persist on disk. Use quotas if you need long-term usage tracking.