Large amounts of Local Incoming Traffic from host IP

GlassWire Help
1

Hello all!

I’ve been using Glasswire Pro for a few months now (love it!) and learning more about my network. However I’m attempting to troubleshoot a significant amount of local incoming traffic over (192.168.1.XX); the interesting thing, is that local IP is the same as the host/PC I’m using Glasswire on (so the traffic is coming from within the machine?) - on average it downloads 2-4GB per day, accounting for 99.5% of all local incomming traffic via the app ‘Bitdefender Network OS Helper Process’. Do you think I should be concerned?

Bitdefender support was no help, and even when I uninstall Bitdefender, I get exactly the same occurence, just against the Host Process for Windows Services app…which is why I’m turning to the experts here!

Host: 192.168.1.XX (same IP as the PC Glasswire is installed on, so essentially coming from itself)
App: Bitdefender Network OS Helper Process

I’m still a novice to networking/Glasswire, so appreciate any guidance or insight!

Cheers!
Peter

2

I found this old post in the Bitdefender forum, does it help?

3

Thanks Ken! Unfortuantely not - even when I uninstalled Bitdefender, I get the same issue (high local incomming traffic off my local machine IP), just with the app changed to ‘Host Process for Windows Services’. Very curious!

4

When searching the Bitdefender forum I found that they may be scanning local network traffic, so perhaps the data usage is due to that scanning.

5

Grab a free copy of Microsoft SysInternals TCPView here: TCPView for Windows - Windows Sysinternals | Microsoft Docs

You should notice that a lot of internal processes, both Microsoft and 3rd party, do establish TCP connections to the local machine. Look for your hostname, or your local IP address listed under “Remote Address”. If these processes pass the VirusTotal test, then there is nothing to be concerned with.

I see both BitDefender and Microsoft entries for local connections on my machine. This is normal.

And Fyi, the address 127.0.0.1 is a local loopback address that is frequently connected to by applications.

1 Like