How does Glasswire know which network connection to use?


#1

I’ve installed Glasswire on a Windows 7 PC that has two physical NICs. One is a normal connection, but the other is connected to a monitor (mirrored) port on the main switch.

I expected Glasswire to have a setting to control which connection it uses, but I haven’t found one. Is Glasswire looking at both connections? Is there any way to control this?


#2

I’m embarrassed to say we didn’t think of this. We’ll discuss this internally and see what we can do. Thanks for letting us know about this problem.


#3

Created an account to add this. My laptop has two connections, wired and wireless, but I also have two other connections for VirtualBox. I am currently using my wired connection, wireless radio turned off, no VM’s running, and GlassWire will not start. Looks like a cool application, will definitely keep my eye on it.

Using Win7 professional on a Lenovo W540. If you need any help testing, let me know.


#4

What error do you see when you try to start GlassWire? Will the installer not start or what happens exactly?


#5

Sorry I didn’t reply earlier. I somehow missed your reply.

Anyway, there’s no problem installing Glasswire, and it also runs okay (aside from the other issues I’ve posted elsewhere). It’s just that I’d like to be able to control which interfaces are monitored.

I’d also like to know how Glassswire deals with traffic from a sensor interface. The traffic on that interface isn’t associated with any particular application running on the same machine as Glasswire; it’s a mirror of all the traffic passing through my LAN, which includes a variety of devices.


#6

Perhaps in our settings we should have a list of network related devices, then allow the user to disable/enable them. Would that solve your problem? Thanks for your feedback.


#7

The setting you describe would do the trick.

What about my other question: how does Glasswire deal with mirrored traffic?


#8

Unfortunately I don’t know how GlassWire deals with mirrored traffic. Nobody has ever asked me that before and I don’t think we have any computers set up that way. Please confirm your technical specifications of how we can recreate your setup and I’ll see if we can test it out.


#9

It’s a standard mirroring setup as required for full network monitoring with tools like Wireshark (see http://wiki.wireshark.org/CaptureSetup/Ethernet#Capture_using_a_monitor_mode_of_the_switch).

The idea is that you normally can’t monitor all network traffic on one computer on a multi-device LAN, because not all traffic makes it to that computer. To get around that, you can configure one port on your switch to be a mirror port, so that all traffic that passes through the switch is echoed to that mirror port. Then you connect that port to a separate port on your monitoring PC, and configure Wireshark, Networx, nLive, SmartSniff, Snort, etc. to look only at that port. It’s extremely powerful.

On the other hand, Glasswire seems to be more about traffic on individual machines (and related to processes) than it is about all LAN traffic. In which case it would be helpful if I could make sure Glasswire is NOT looking at the monitor port. Hence the request for a setting.


New feature request for logging
#10

Very cool! We will study this more carefully and see if it’s possible to disable the monitor port via settings.


#11

I was just wondering if you folks had made any progress on this. Glasswire has a lot of potential for doing more comprehensive monitoring, but if it doesn’t allow for selection of which network connection to monitor, and doesn’t handle mirrored traffic in a meaningful way, it will only ever be of limited use for serious traffic monitoring.


#12

We’re still working on this.


#13

Hi, just registered here to let you know, having this feature would be an absolute diamond! Being able to select which interface to monitor. I have my pc running as a wlan0 to eth0 bridge to my GbE switch, in order to give internet to my pc with fried usb ports (its a fileserver and needs to be fast)

Would be very appreciated! Apart from that, I LOVE the application! Thankyou very much


#14

Also looking forward for that feature, can’t believe it is not here yet :slight_smile: