If I block an app, how can I later see what host/ip address the app was trying to connect to?

I launched Windows Word for the first time and Glasswire’s firewall ASK TO CONNECT popup said winword.exe wanted to connect to the internet. I denied it access to the internet. I didn’t study the popup closely at the time.

How can I now go back and see what Host/IP address winword.exe was trying to connect to?
Since I denied access I don’t see it in the Alerts or Graph.
All information (date/time, destination host/ip) about the app trying to connect seems to be lost when I deny an app access to the internet.

When an app is denied access to the internet, is there anywhere in Glasswire where I can later see the same type of information that is reported in the ALERTS log?

When I click on the Winword.exe app in the Firewall list it does not have any historical activity info (like the Alerts), such as first/last time the app was denied access and what host/IP it was trying to connect to.

1 Like

@JoeyT

Before you allow or deny the connection, it shows the connection in our “Ask to connect” window.
asktoconnectoutlook

I made Outlook try to connect to show an example similar to the one you mentioned. You can then mouse over the host, and it will have a three dot menu where you can see more host info. Or you can go to https://www.glasswire.com/host/52.109.8.19 and see what the host is the app is trying to connect to.

Once you deny the connection though we don’t save the host since the connection failed, but perhaps we should look at doing that for the future. Thanks for your feedback.

2 Likes

When the First Network Access popup occurs I am usually too busy to spend time to research the IP/Host/App, I just automatically click Deny.

It would be nice to have a log/Info button where we could see what was occurring at the time we clicked Deny. Hope to see this feature/log included in a future update.

1 Like

An expanded toast notification would be nice.

Examples:


1 Like

Saving the host is irrelevant, unless I misunderstand your exact meaning.

I noted on this a ways back… May, 2017.

Given if deny is chosen it’s because the user determined (read: panicked) as such and then there is no way to find out what was involved.

The info should be available after the fact and gleaned from an entry in Alerts as “First network activity - Network access denied,” not in “Ask to connect” when a possibly malicious process is fully active albeit waiting on a connection.

As well a “Network access allowed” should be posted. Because this and denied are similarly not posted in alerts until an actual allowed actual, but NOT denied, connection is made. That is, there is a only “connection initiated” alert, but not a “connection blocked.”

The lack of complete and differentiated “access” and “connection” alert posts for allow and deny has been IMHO a One Big Fail in the otherwise superb features in GlassWire.

1 Like

I just came across the same issue. I am looking for the host which I have just blocked from an app two hours ago, but it could not be found. The blocked host is needed to be reused for investigation which is just a simple requirement for a fw. Quite a lot of basic needs could not be found from GW which I wonder if I should not continue after the end of subscription.