Glasswire does not see WSL Linux subsystem for Windows 11 traffic

So, I’m using Kali Linux on a Windows 11 host with the WSL Linux subsystem. I’m interested in using Glasswire to monitor all my traffic, including the traffic coming from/to the Linux subsystem. However, this traffic is not detected by Glasswire.

More strange is the behaviour of Task Manager. The traffic between the host and Linux subsystem is registered on my Ethernet interface and WSL Virtual Ethernet interface. However, the traffic between the host and Internet originating from the Linux subsystem doesn’t seem to be registered in Task Manager.

Below is an example:

Here I’m downloading a file using the Linux shell. I can see the network traffic between the host and Linux. But I can’t see the Internet traffic coming to the host in the first place. As you see, the throughput between the host and Linux subsystem matches on the 2 interfaces.

If I go to processes and sort by network usage, I don’t see any Windows process using the network, although network usage is listed at 20%.

I’m assuming that there is some underlying Windows WSL magic going on that makes this traffic undetected. If I can’t see it in Task Manager, I don’t imagine I would see it in Glasswire. However, it would be interesting to see what insights the dev team has to bring to this.

Windows Version: Windows 11 Pro 21H2
OS Build: 22000.348
Glasswire version: 2.3.374

If you restart your PC does the traffic appear, or does it make no difference? I ask because if GlassWire is newly installed we warn users that you should restart to detect all traffic on your PC. Perhaps in this case GlassWire is newly installed?

If GlassWire isn’t newly installed then perhaps the API we use that’s provided by Windows to detect all traffic is purposely made by Microsoft to ignore the Linux Subsystem?

I will ask someone on our team who uses the Linux subsystem to see if they can recreate this or not.

I restarted already, it makes no difference. It must be due to the Windows API.

1 Like