The App Tab - Firewalla App Android & Probably IOS

Can somebody please post an article on the Tab.

I am assuming based on installation after 7 days that this tab is using packet sniffing to determine what application in running or maybe the actual IP address of the destination to determine the useage reported in the the Firewalla application.

Are you using the port flag?  How are you determining this, you are obviously using the contents of the frame, but how.

How does this work please?