GlassWire is seeing Plex traffic as usage

GlassWire Help
1

Hi there,

I noticed after upgrading to GlassWire 1.2.64b, that my Plex streaming, all local mind you, is being counted by GW.

This is all on my local network. Plex Server and Android phone are on same network. So it shouldn’t be using any external data, but it’s being logged as external data in GW. I am not sure if it’s actually being logged by my ISP, since they can’t tell me what data they are seeing go into the modem. But thought I would ask here to see if its a bug or issue.

Here is a screenshot:

gwPlex.png700×514 11.6 KB

2

@sinyc
Do you know if the network is using IPv4 or IPv6? With IPv6 it’s difficult to detect what is local or external.

3

@Ken_GlassWire
As far as I can recall its using IPv4. I believe I unchecked the IPv6 on my NIC on my plex server. But it’s only after upgrading to this latest version that it’s been picking up Plex traffic. I do have a data cap with my ISP, and they do not appear to be counting the traffic.

Just was wondering why GW did since it messes up my calculations of legit traffic towards my data cap.

4

Our latest version is 1.2.71. Please try that new version and see if you continue to see this problem, also please double check if it’s IPv4 or 6. Thanks!

5

@Ken_GlassWire
Hi Ken, I upgraded to 1.2.71 and it’s still show Plex as “external” and “local” but the host is the IP of my router with it’s internal IP.
I also verified that IPv6 is disabled on my Plex server.

SO maybe GW is just picking it up in the last few updates for some reason?

6

Thanks for your report. I’ll discuss this with our dev team and see if they have some ideas why this is happening. Did anything change with your network recently?

7

Nothing has changed. Same hardware, router, modem, NIC, etc.

8

why is it so hard to check for local transfer?

IPv6 is nicely split into what is what.

http://www.ipv6-portal.de/informationen/einfuehrung/adressbereiche.html (german, but the headings are english and the addresses below)

2000::/3 is for the general internet, so anything that starts with 2 or 3 is for the internet
and then we should maybe keep multicast in mind.


see that the format is 8 bit prefix (1111 1111 or ff for multicast), 4 bit for flags (not important here, ) and 4 bit for scope (1111 1110 or e for global/internet)
we need to keep ffXe::/16 in mind for that (X being the flag which does not matter)
so we need to keep an eye on these addresses

2000::/3
ff0e::/16
ff1e::/16
ff2e::/16
ff3e::/16
ff4e::/16
ff5e::/16
ff6e::/16
ff7e::/16
ff8e::/16
ff9e::/16
ffae::/16
ffbe::/16
ffce::/16
ffde::/16
ffee::/16
fffe::/16

by the way is there a way to diable ctrl+enter? when multi-pasting this gets annoying and I never use it in the first place.

9

We were able to recreate this problem and we plan to fix it for the next update. Thanks for your report and sorry for the problem.