How does Glasswire know which network connection to use?

I’ve installed Glasswire on a Windows 7 PC that has two physical NICs. One is a normal connection, but the other is connected to a monitor (mirrored) port on the main switch.

I expected Glasswire to have a setting to control which connection it uses, but I haven’t found one. Is Glasswire looking at both connections? Is there any way to control this?

I’m embarrassed to say we didn’t think of this. We’ll discuss this internally and see what we can do. Thanks for letting us know about this problem.

Created an account to add this. My laptop has two connections, wired and wireless, but I also have two other connections for VirtualBox. I am currently using my wired connection, wireless radio turned off, no VM’s running, and GlassWire will not start. Looks like a cool application, will definitely keep my eye on it.

Using Win7 professional on a Lenovo W540. If you need any help testing, let me know.

What error do you see when you try to start GlassWire? Will the installer not start or what happens exactly?

Sorry I didn’t reply earlier. I somehow missed your reply.

Anyway, there’s no problem installing Glasswire, and it also runs okay (aside from the other issues I’ve posted elsewhere). It’s just that I’d like to be able to control which interfaces are monitored.

I’d also like to know how Glassswire deals with traffic from a sensor interface. The traffic on that interface isn’t associated with any particular application running on the same machine as Glasswire; it’s a mirror of all the traffic passing through my LAN, which includes a variety of devices.

Perhaps in our settings we should have a list of network related devices, then allow the user to disable/enable them. Would that solve your problem? Thanks for your feedback.

The setting you describe would do the trick.

What about my other question: how does Glasswire deal with mirrored traffic?

Unfortunately I don’t know how GlassWire deals with mirrored traffic. Nobody has ever asked me that before and I don’t think we have any computers set up that way. Please confirm your technical specifications of how we can recreate your setup and I’ll see if we can test it out.

It’s a standard mirroring setup as required for full network monitoring with tools like Wireshark (see http://wiki.wireshark.org/CaptureSetup/Ethernet#Capture_using_a_monitor_mode_of_the_switch).

The idea is that you normally can’t monitor all network traffic on one computer on a multi-device LAN, because not all traffic makes it to that computer. To get around that, you can configure one port on your switch to be a mirror port, so that all traffic that passes through the switch is echoed to that mirror port. Then you connect that port to a separate port on your monitoring PC, and configure Wireshark, Networx, nLive, SmartSniff, Snort, etc. to look only at that port. It’s extremely powerful.

On the other hand, Glasswire seems to be more about traffic on individual machines (and related to processes) than it is about all LAN traffic. In which case it would be helpful if I could make sure Glasswire is NOT looking at the monitor port. Hence the request for a setting.

2 Likes

Very cool! We will study this more carefully and see if it’s possible to disable the monitor port via settings.

I was just wondering if you folks had made any progress on this. Glasswire has a lot of potential for doing more comprehensive monitoring, but if it doesn’t allow for selection of which network connection to monitor, and doesn’t handle mirrored traffic in a meaningful way, it will only ever be of limited use for serious traffic monitoring.

We’re still working on this.

1 Like

Hi, just registered here to let you know, having this feature would be an absolute diamond! Being able to select which interface to monitor. I have my pc running as a wlan0 to eth0 bridge to my GbE switch, in order to give internet to my pc with fried usb ports (its a fileserver and needs to be fast)

Would be very appreciated! Apart from that, I LOVE the application! Thankyou very much

1 Like

Also looking forward for that feature, can’t believe it is not here yet :slight_smile:

1 Like

Chiming in here. Glasswire looks like an interesting product, but I can’t justify it from a single device point of view.

Like the other here, I have a “monitor” interface setup. I have a monitored/mirrored port on my switch going into a virtual switch that’s mapped to a virtual NIC on a virtual machine. If I were able to choose which interface I wanted Glasswire to monitor, this would essentially allow me to monitor my entire inbound/outbound network connection, which would be great.

Seems like a very cool and easy to use product, and I’m especially curious about the Remote Access tab. But my testing stopped when I couldn’t specify an interface. And after research this thread & functionality appears dead.

Please let me know if this ever becomes an option, or if it currently is an option and I’ve missed it.

Respectfully,
syn

1 Like

@synthetiq

GlassWire is an endpoint monitor and personal firewall for monitoring and blocking apps. Our Android app does the same for phones. You can see below how GlassWire’s usage tab is showing network activity for apps, hosts, along with different traffic types used by an individual PC.

We don’t monitor the entire network or connect to switches. Our feature list is here. https://www.glasswire.com/features/

Currently GlassWire monitors ALL connections on your device (all interfaces simultaneously) but it’s also on our road map to allow customers to choose different network interfaces.

We’d also like to monitor the full network someday with perhaps a completely different product, but that’s not what we do currently. Thanks for your feedback.

You can also monitor one remote device for free if you want to try it. https://www.glasswire.com/userguide/#Remote_Monitoring It does not require selecting a network interface to use this feature.