Guide 10 of 10

Troubleshooting and FAQ

Short answers to the things people ask most, and a checklist for when monitoring will not start.

Common questions

An app stopped working after I turned on Demarc.
Find it in Watch › Live filtered to Blocked to see what stopped it and why. If it was a rule or list, switch that off or add an Allow rule above it. If the app simply does not tolerate a VPN, add it to Excluded apps and restart monitoring.
Monitoring turned itself off.
Only one VPN can be active on Android. Another VPN app, or revoking Demarc’s permission, ends monitoring, and Demarc posts a notification. Open the app and tap Start. For the longer term, turn on Always-on VPN in Settings.
Nothing on the phone gets online while the screen is off.
Android may be suspending Demarc to save battery. Allow the battery exemption in Settings › Permissions.
I turned a blocklist on and nothing is blocked.
Individual lists apply only while Dangerous sites is on at the top of Blocklists, and lists must be downloaded: tap Update now. Also, monitoring has to be running. A warning icon on a list means its download failed.
An app has no grade.
Apps are graded only after about 64 KB of traffic has been seen. Until then the Apps tab shows a progress bar.
The Live list shows no site names for some connections.
The site name comes from the connection itself. Connections that hide it (Encrypted Client Hello) or that were opened by IP address show the address instead. Turn on the location database for the country and operator.
The Countries rule field does not match anything.
Country and operator rules need the offline location database. Turn it on under Guard › Where your data goes.
I can see an app’s traffic, but not its DNS lookups.
That app is probably using its own encrypted DNS, or your phone uses Private DNS. See Apps with their own lookups.
A rule is not doing anything.
Rules are checked from the top and the first match wins, so a rule above it may already be deciding. Check the order, check the rule’s On/Off switch, and check that monitoring is on and Demarc is not paused.
Does Demarc see inside encrypted traffic?
No. It never decrypts anything. It sees metadata: who connects to whom, when, how much, and the site name, but not the contents of a secure connection.
Does Demarc send my data anywhere?
No. Everything is analysed and stored on the phone. It downloads the blocklists you enable and, if you choose, the location database, and nothing about you is sent with those requests.
Do pings work?
ICMP, including ping, is not forwarded while Demarc is running, so ping tests will fail.

If monitoring will not start

  • Is another VPN connected, or Always-on VPN set to a different app? Disconnect it, then tap Start.
  • Did you decline the Android Connection request? Tap Start again and accept it.
  • Tap Open VPN settings on the Couldn’t start monitoring card and check what Android reports.
  • Still stuck? Write to connect@netapi.io.