• Beginner
• 6 min read
• Updated 2026-10-09

The dashboard is dense: two live charts, a time range that rewrites everything below it, four totals, and two more charts. None of it is decoration, but a couple of numbers are easy to misread — above all traffic saved. This guide walks it from top to bottom and says what each item measures, and what it does not.

Traffic speed

The top card is Traffic speed / 网络速度: your current upload and download rate, drawn over the last 60 seconds. The x-axis runs from 60 s ago on the left to now on the right, so the chart is a rolling minute that slides forward as time passes.

This is a rate chart, not a total. A flat line at zero does not mean something is broken — it means nothing moved during that second. Phones sit idle most of the time, so a healthy chart stays near zero and spikes when an app fetches something. Read the shape over a minute, not any single instant.

The Start protection / Stop protection button sits directly under this chart. While the engine is coming up it shows Starting…, and if it cannot start it says so rather than leaving you guessing. If it refuses to start, see when protection will not start.

The time range changes everything

A segmented control under the speed chart reads Today / 7 days / 30 days. It is not a filter for the charts alone: it changes every statistic below it — the four tiles, both donuts, and the Top 5 apps list.

That is the thing most worth knowing about the dashboard. Blocked on Today and Blocked on 30 days are different measurements, and comparing them is the usual way to misread the screen. Before you compare two numbers, check they were taken over the same range.

The four tiles

Connections is also a door: tapping it opens the per-app list, covered in See and control what each app does online. Traffic saved gets its own section at the end of this page, because it is the number most people read wrongly.

Blocked breakdown

Blocked breakdown / 拦截构成 is a donut that splits blocked connections by the module that caught them — ads, trackers, malicious sites, the deep URL layers — plus one slice for blocks your own rules caused. Two honest notes:

• It counts blocked connections, not unique domains. One tracker contacted ten times counts ten times, not once. The slices compare how busy each source is, not how large its list is.
• When there are many slices, the smallest are merged into a single Other / 其他 slice, so the chart stays readable.

A small slice does not mean a module is weak: the malicious-site list has the most entries of any module, yet it looks small here if you never visit malicious sites — which is the point. For what each module is, see Modules.

Traffic destinations

Traffic destinations / 流量去向 is a donut of where your traffic actually went, grouped by registrable domain — the eTLD+1, the site name plus its public suffix. So cdn.example.com, api.example.com and www.example.com all fold into one example.com slice, and a CDN’s many subdomains do not fragment into dozens of thin rows. That grouping is what makes the chart readable at all.

It uses a fixed common-suffix table, not the full Public Suffix List. Ordinary multi-part suffixes are handled correctly, but an unusual or newly introduced one can occasionally be grouped wrongly. Treat the chart as a good map of where traffic goes, not a legal filing.

Top 5 apps

Top 5 apps / 应用 Top 5 lists the apps that moved the most traffic in the selected range. More / 更多 opens the full history list — the same destination as tapping the Connections tile.

DNS resolvers and intranet IP

DNS resolvers / DNS 解析服务 lists the DNS servers currently in use. Servers your current network handed you are marked from your network; ones you set yourself under Encrypted DNS are not. The difference matters: a network-provided resolver is one your carrier or the Wi-Fi owner can see.

Intranet IP / 内网 IP is your address on the local network. Off Wi-Fi it shows Not connected to a local network — normal, not a fault.

How “Traffic saved” is estimated

Traffic saved / 已节省流量 is the most interesting number here and the easiest to misread, so here is exactly how it is produced.

Each blocked connection is priced at what the same hostname delivered, on average, per allowed connection. If ads.example.net was allowed ten times and delivered 40 KB in total, then every later block of ads.example.net is credited 4 KB.

It deliberately does not borrow an average from the whole registrable domain. That would be tempting — “example.com averages 3 MB a connection, so a block saves 3 MB” — but a domain shared with video or downloads would then hand video-sized averages to its tracker subdomains, and saved would climb above your real traffic. Pricing per hostname keeps the figure anchored to something that actually relates to the block.

When a hostname was only ever blocked, there is no allowed traffic to average, so each block falls back to a fixed 16 KiB. That is a convention, not a measurement.

So treat Traffic saved as an estimate, and one that can be wrong in both directions. Blocking a hostname that would have delivered a large file understates the saving; blocking a tiny beacon that shares a hostname with something bigger overstates it. It is best for comparing one period with another and for confirming that blocking is doing work — not for claiming an exact amount of data you did not use.

Next

• See and control what each app does online — from a blocked connection to a rule
• Modules — the bundled lists behind the donut
• Install ClearDeck and turn on protection — if you have not started yet

This guide is also available in 简体中文