Hey guys, reporting that I too am having the same problem / bug.
Open your task manager and click on the performance tab as
an alternate way to check your network connections.
Here is a short video that can assist you with work arounds:
Hey guys, reporting that I too am having the same problem / bug.
I just created an account to bump this, THIS HAS TO BE FIXED!
I noticed this issue after “System” started spamming a ton of different gameservers with NetBIOS traffic that were automatically pinged in the server list for latency tests for a game, even long after I closed it.
The data usage might not be big but it adds up, GlassWire is literally spamming IPs with garbage traffic.
I just disabled NetBIOS and it stopped now.
By the way, I am not sure how exactly NetBIOS works but there is often talk of security issues with it, is this a concern with queries like this?
GlassWire does not spam anything.
Our software does nslookups on hosts you connect to so inside GlassWire you can see when you connect to an IP, it resolves to Google.com for example. This is a popular feature of our software and it uses no noticeable resources.
However, if an nslookup on a host is upsetting to you for some reason you can disable nslookups so you can no longer resolve hosts you connect to.
- stop the GlassWire service;
- open C:\ProgramData\GlassWire\service\glasswire.conf as admin;
- change the value to
- save the changes and restart the GlassWire service.
I think you don’t understand what we are talking about here, especially since you renamed the thread from “NetBIOS” to “BIOS”, something unrelated.
When I disable NetBIOS in Windows, the “spam” from GlassWire stops, but the host names are still resolved. This can be confirmed by doing nslookups manually, these two things are completely unrelated.
NetBIOS is a different type of name resolution, due to a weird thing in Windows, it tries to do it before the normal DNS lookup if certain network conditions are present (legacy devices or bad router config, which is common in ISP routers). This also likes to get stuck and do other weird stuff.
While it technically “isn’t your job to fix” as it is partly a Windows issue, considering how common this is, you should look into providing a workaround, possibly in the form of a setting to prevent this from happening.
It is also a privacy issue as this NetBIOS spam occasionally continues for a while after the connection has stopped which may be an issue for VPN users.
Edit: Just to be clear: “System” (probably on behalf of GlassWIre) sends NetBIOS requests to hosts for multiple minutes after the initial connection, there is no way that is intended behavior.
GlassWire doesn’t do anything on the network besides check for updates (software and malicious host list) once per day, and do nslookups on hosts. Instructions on how to disable nslookups are above in this thread.
If you don’t want GlassWire to check for updates you can make it block itself under its own firewall.
GlassWire does not do anything with the NetBios.
Maybe you are just looking at traffic between our service and our UI on your own PC or something like that? If that’s the case, then this is local traffic between our service and UI and it does not use the network at all.
Again, this is 100% a NetBIOS related issue, disabling NetBIOS over TCP/IP removes this traffic. Someone in this thread also said that this occurs due to the lookup order in Windows.
Frankly, I suspect that unless you write your own nslookup this will remain an issue.
Wouldn’t just using the DNS cache make nslookups unnecessary?
Thanks for your feedback.
GlassWire itself is just a network monitor and it doesn’t really use any significant network resources, besides doing some simple nslookups and software update checks. And as I posted previously you can make GlassWire block itself with its own firewall, and instructions on how to disable nslookups are above.
Also, please note our Android app has no ability to access the network at all.
I will submit this thread to our team and see if they have any comments.
Our team asked if you tried the nslookup disable option as suggested above, and if that made the NetBios traffic you are seeing go away or not? Thanks.
I just tested it and it made the traffic successfully go away (I made sure to turn NetBIOS back on during the test).
It’s still something that should be addressed, considering it seems to be an issue with nslookup looking up NetBIOS instead of directly jumping to DNS/hostfile it shouldn’t be necessary to completely disable that functionality (If you can’t just disable NetBIOS).
Just adding that when checking the network traffic in my PC (Win10 Pro) I saw NetBIOS traffic as well (didn’t check if it was GlassWire related) but I’ve turned off the NetBIOS for my network adapter so it would stop
If you have our nslookup feature on, but your PC is in “Block All” mode and you don’t see any network activity in GlassWire, do you see NetBios activity?
I’m asking because if it’s the nslookups somehow, then if GlassWire is NOT doing any nslookups (due to no network activity) then perhaps there should be no NetBIOS activity?
Also if GlassWire’s service is killed do you see NetBios activity? Thanks.
The NetBIOS traffic stops when Block all is on. (And it resumes when it’s off, I just tested it)
I am not set up to check if it stops when the service stops (GlassWire obviously doesn’t record activity when it’s stopped) but considering the nslookup feature is clearly the culprit here as disabling it fixed the issue it has to be an issue with GlassWire.
The way to know if the nslookups are the issue would be to stop our service, then watch the NetBios traffic. We’re unable to recreate this on our end.
Please let us know if you’re able to check and what you find. Thanks.
If you guys go to Control Panel -> Network and Internet -> Network Connections (adapters) -> Right Click the adapter you use -> Properties -> IPv4 (click Properties when selected) -> Advanced… -> WINS -> Enable NetBIOS over TCP/IP (it should force it on without router config) and then turn on nslookup in GlassWire config and go to websites (websites with CDN like youtube or twitch are the best) do you see NetBIOS traffic from “System”?
Doing this should to my knowledge replicate what is happening for me and the other users. If this doesn’t work for you please let me know because I can try something but it might be a bit difficult and I don’t want to waste time figuring it out if this replicates it for you guys.
I deleted my previous post because my edits got out of hand.
I tried reproducing your issue, @Thinking, but I wasn’t able to do it on Windows 10 -
NetBIOS over TCP/IP are enabled and GlassWire nslookups are enabled in hte config file.
NetBIOS traffic is as I would expect, each broadcast arising from a specific application but attributed to the SYSTEM application. The one issue I found is that the
NetBIOS Name Service appears to include DNS name resolution.
So @Ken_GlassWire, does what GlassWire shows as
NetBIOS Name Service actually include DNS name resolution?
Here’s some reasons why I think it does:
URLs that are resolved through my web browser also appear under
NetBIOS Name Service.
NetBIOS Name Servicehas external traffic.
I have Windows Firewall running and it should limit NetBIOS broadcasts to the subnet, but there is external traffic showing. Whereas the
NetBIOS Datagram Serviceand the
NetBIOS Session Servicedon’t get out of the subnet, as expected.
Using the NetBIOS utility
NBTSTATwith only an IP address generates a URL in GlassWire
nbtstat -A 22.214.171.124
Although there was no matching NetBIOS name in the cache, GlassWire
Trafficshowed the correct URL under
NetBIOS Name Servicei.e. 126.96.36.199 resolves to outlook.ms-acdc.office.com. But the name resolution doesn’t appear to be done by DNS as it doesn’t appear in the DNS cache:
I haven’t used other tools to check what is actually happening but it wouldn’t be difficult, just too time consuming for me right now.
That’s literally what I was talking about, SYSTEM is sending NetBIOS requests on behalf of GlassWire?
NetBIOS traffic does not include DNS, if I enable NSlookup in GW and disable NetBIOS in Windows, I don’t get that traffic anymore.
It is an issue with the order how stuff is being looked up, when Windows thinks NetBIOS is used on the network it will do it before DNS.
So far I can only confirm those generated by WIndows NetBIOS. I’d have to either monitor the processes or monitor network traffic (before and after GlassWire is installed) and I don’t have time for that.
Anyway, the best solution for me and 99.9% of users is to disable
NetBIOS over TCP/IP which we should be doing anyway because of the security vulnerabilities it creates (see the link below). @Ken_GlassWire, It might even be a worthwhile security measure for to GlassWire help users to turn it off if it is on.
The only reason to keep using NetBIOS is if you run an old application that requires it. Typically, we’re talking about applications from about twenty years ago.
I’m still interested to know why there is NetBIOS external traffic because it was limited to the subnet at one time. I remember when Microsoft limited NetBIOS by default and there was a big outcry from those with systems that didn’t use FQDN for SMB/CIFS. Maybe Microsoft reversed that change.
Thank you for your feedback on this issue.
We have now researched this issue in detail.
If you don’t like GlassWire to do nslookups you can change the config file as recommended above. We’re considering adding a simple on/off switch for this feature in the future.
The way our nslookups work is that we use a standard Windows API to do an nslookup. In fact, if you do an nslookup in the Windows command prompt it works in an identical way. The reason we know this is because we checked this and confirmed it works the same way.
So, in summary, GlassWire does nslookups using a Windows API and it’s the same way the Windows command prompt does an nslookup. If you are unhappy with this you can disable nslookups with GlassWire using our config file.
Or, you can disable NetBIOS traffic with the Windows OS.
Right click the start menu > Network Connections > Right click your connection > properties > Click Internet Protocol Version 4 (TPC/IPv4) > Properties > Advanced… > WINS tab > Disable NetBIOS over TCP/IP
I think Remah also mentioned this option along with some other helpful commentary.
Further support for disabling
NetBIOS over TCP/IP is that Internet Service Providers (ISPs) are stepping in to block NetBIOS. The largest ISP in my country (44% market share) has just announced that they will block the ports for both NetBIOS and SMB:
Just a quick heads up on a change we’re making to our Broadband network to increase customer security. As per industry best practice we’re going to start blocking the ports used for SMB and NetBIOS on our Broadband connections. Those protocols are fairly well documented to be insecure and should never be used outside your own LAN - i.e. never on the internet.
The specifics of the ports being blocked are:
Incoming TCP ports 135->139
Incoming TCP port 445
This was implemented for Wireless Broadband Static IP nationwide from day 1. It is now being progressively rolled out across ADSL/VDSL and [Fibre]…
How common is the practice of ISPs blocking NetBIOS (and also SMB)?
- Microsoft provides Guidelines for blocking specific firewall ports to prevent SMB traffic from leaving the corporate environment
- US Homeland Security recommended this in early 2017: this article has links to relevant Microsoft articles.
- It was a common practice even earlier: 2015 list of mainly American ISPs that allow or disallow port 445.
Note that newer versions of SMB are much less vulnerable security risks
What the above articles doesn’t say is that newer versions of SMB reduce the risks dramatically. It is the older SMB formats that carry the greater security risks when exposed on the Internet.
- SMB 1.0 is used for Windows XP which has been out of support since 2014. Nobody should be using it on the Internet.
- SMB 2.0 is used for Windows Vista and 7 and has better security turned on by default in Windows but this is not the case for third-party products.
- SMB 3.0, which was introduced with Windows 8 and Windows Server 2012, provides end-to-end encryption that removes much of the risk.
I just remembered this thread and would like to ask a couple questions that you guys might know answers to regarding the nslookup behavior which could be very important:
Are NetBIOS lookups actually a security issue?
From what I’ve gathered it is only intended for local networks, so there isn’t an issue with the netbios service UPNP forwarding itself (e.g. opening a port). Can the lookups still be exploited?
While it was active, I received one or two seemingly* inbound connections (e.g. 0 bytes sent) from Shodan Census (Crawler) and some Chinese botnet server assigned to the System entry (only around 200bytes and no other activity, I checked using autoruns, procexp, etc.). During this time I didn’t have any application opening an Upnp port, is is possible that this was a sideeffect of the NetBIOS request? It never happened again after disabling it.
*This might be a bug with GlassWire, seemingly incoming requests to the System entry also happened with Battlefield and GMod game servers while NetBIOS was active (only around a couple bytes).