"Specious" alerts?

richlife69 · February 13, 2016, 4:02pm

I get two alerts from Glasswire that appear to be information only though they would indicate a problem, but for which I can’t determine an explanation.

1- On my main Glasswire client, two or three times a day, I get the alert that “Internet access changed – internet connection was lost” as shown here (the Graph screen shot below also shows that warning). But there is no corresponding notice of any reconnection and at no time can I find that my internet connection was ever actually lost. The alert contains no information to define this “loss”. And the remotely connected machine shows no such alert during the same time period (see the last two screen captures).

2- My remote connected machine (Sony), will often show the alert “Glasswire client connection – Glasswire remote client disconnection” at apparently random times. Some time later an alert show reconnection. But again there is no further explanation and there is no indication of a disconnection that shows on my main Glasswire client. From examining the two graphs, it does appear that my main client was active during the time of the two connection/disconnections at 6:44 through 7:54 and I may have switched my main client to look at the remote server. Is that the explanation? However, if that is true, then there is no corresponding disconnection following the 10:25am alert when I know I checked the remote server and have now returned to my main client.

I’m just trying to understand where there apparently “specious” alerts come from. There does not appear to be a problem. BTW, in Usage Options, I have all alerts active except the camera and mic monitor.

Ken_GlassWire · February 14, 2016, 5:01pm

Do you see these alerts with the new unreleased version or is this alert with our public version? I’m seeing false DNS change alerts with the unreleased version now currently also so maybe it’s related to this bug.

richlife69 · February 15, 2016, 5:43pm

This is all with 1.1.41 – and previous releases. (I only report issues with the test versions back to my test contact. “They” are seldom identified. :<) I have yet to be able to successfully install the latest test release.)

It might be related to those DNS changes – but when I’ve seen DNS changes I tend to notice it and know what generated it.

Ken_GlassWire · February 15, 2016, 5:56pm

Thanks for your report. We’ll try to reproduce this on our end. Hopefully it’s similar to the DNS change bug I’m also seeing.

richlife69 · February 15, 2016, 9:08pm

Notice these alerts.

I was specifically on line (see the time I came off Idle time) after being away for a day to attend a wedding. I was actually working on this forum first thing after getting on (may even have been during my last post – they aren’t time stamped). I did not note the alert come in, but nor was there any indication that anything odd was taking place on my network – especially not a lost internet connection.

Just explaining a realtime experience – thanks for looking at this.

Rich

Servo_GlassWire · February 17, 2016, 11:50am

Is it possible your PC is going into sleep/hibernation while you’re away?

richlife69 · February 17, 2016, 3:03pm

My PC definitely goes to sleep after 30 minutes inactivity, but that can’t explain either of the alerts I see. As I said above, the alert indicates internet connection was lost 5 minutes after I came back on. In the first screen capture above, the “loss” occurred before I came back online and hours after “sleep” started. And then again multiple time during Idle Time including just before I got back online.

One instance of the “client connection” of the remote machine occurs one minute after “internet connection was lost” on my main Glasswire client.

Ken_GlassWire · February 17, 2016, 3:39pm

We decided to add back our original alert when the Internet is re-connected. I think it will help solve this issue.

Could you see if this helps?

You may try to disable the power management feature in network adapters:
a. Click Start
b. Right Click Computer
c. Click Manage
d. Click Device Manager in the left window pane
e. Expand Network Adapter.
f. Now you will see your network adapter or adapters if you
have more than one. Right Click on network component and click
Properties.
g. Go to the Power Management Tab.
h. Make sure all boxes are unchecked.
i. Once you’ve unchecked the boxes click ok and restart your
system. Put the computer into sleep mode and check if you still have
issues.

richlife69 · February 17, 2016, 4:10pm

Ok, I’m trying this out and will watch for results. I can see how this might stop the alerts for “internet lost” and the re-connect alert (which I think is a good idea) may help me pinpoint the activity. I still question the repetitions, but let’s wait and see what the outcome of not turning off my adapter is.

Thanks, Rich

netninja_jk · December 17, 2018, 4:44am

I revive this three-year-old topic with caution, but it’s the only other support forum error that looks similar to mine, also involving the “internet access lost” message.

Richlife- any news? Thanks in advance.

Remah · December 17, 2018, 6:01am

@netninja_jk

GlassWire has no “internet access lost” message. I assume that you mean the notification “Internet access has changed” with the message “Internet connection was lost”.

There is advice about this issue in another topic about a different problem:

Anyway, you reminded me to have look at this again.

@Ken_GlassWire, here’s what I found.

On my laptop, most of the notifications aren’t related to sleep, hibernation or shutdown. Rather they correspond with Windows attempting to set the best DHCP profile for my current WLAN connection. One problem is that my network connection is actually by cable not by WLAN - see the cable connection symbol with the WLAN SSID displayed.

So it appears that the attempt to find the correct WLAN profile registers as a network disconnection. It shouldn’t because the laptop is Ethernet/cable connected:

You can see an example of three GlassWire alerts at 7.32, 9.05 and 11.00am:

You can also see the three sets of two Windows DHCP Client Events also at 7.32, 9.05 and 11.00am:

The first event is that DHCP finds the WLAN SSID for the current profile:
"DHCP has received a Service Set Identifier(SSID) ... for the Network Card with the network address ...":

The second event is that DHCP finds the cached profile for that SSID:
"DHCP has found a match in the cache for Service Set Identifier(SSID) ... for the Network Card with the network address ..."

Here's the detail for the query event:

```` - System - Provider [ Name] Microsoft-Windows-Dhcp-Client [ Guid] {15a7a4f8-0072-4eab-abad-f98a4d666aed} EventID 50067 Version 0 Level 4 Task 3 Opcode 57 Keywords 0x4000000000000000 - TimeCreated [ SystemTime] 2018-12-15T22:00:33.241261100Z EventRecordID 684 Correlation - Execution [ ProcessID] 1516 [ ThreadID] 12852 Channel Microsoft-Windows-Dhcp-Client/Admin Computer MA07 - Security [ UserID] S-1-5-19 - EventData NetworkHintString Jabberwock2.4 NetworkHint A4162626562777F636B623E243 HWLength 6 HWAddress 685D43092135 ````

Here's the detail for response event:

```` - System - Provider [ Name] Microsoft-Windows-Dhcp-Client [ Guid] {15a7a4f8-0072-4eab-abad-f98a4d666aed} EventID 50065 Version 0 Level 4 Task 3 Opcode 55 Keywords 0x4000000000000000 - TimeCreated [ SystemTime] 2018-12-15T22:00:33.241265700Z EventRecordID 685 Correlation - Execution [ ProcessID] 1516 [ ThreadID] 12852 Channel Microsoft-Windows-Dhcp-Client/Admin Computer MA07 - Security [ UserID] S-1-5-19

- EventData 
  NetworkHintString Jabberwock2.4 
  NetworkHint A4162626562777F636B623E243 
  HWLength 6 
  HWAddress 685D43092135

</details>

Ken_GlassWire · December 17, 2018, 3:23pm

Interesting…

I will report this to the team to double check this feature. We chose to disable this feature by default because most people find it annoying… especially laptop users.

richlife69 · December 17, 2018, 3:35pm

And that would explain why I haven’t been seeing it.

Remah · December 17, 2018, 3:43pm

I just noticed that the Ethernet connection is actually named differently so that is probably not related to the DHCP issue:

WLAN SSID is “Jabberwock 2.4”
Ethernet is “Jabberwock2.4 2”

Now I need to check out what is causing the similar network name.

Remah · December 17, 2018, 3:56pm

Interesting that the Network name with a WLAN connection is the same as for Ethernet:

Ken_GlassWire · December 17, 2018, 6:34pm

I investigated this issue and found we use a Windows API to check if a connection is lost or not. It’s not some magic we’re doing on our side that can be rewritten somehow. If the API is not functioning correctly there isn’t much we can do.

Our QA will test more in detail to see if the feature works as expected or not.

Thanks for your feedback so we could know about this problem and test it more in detail.

Remah · December 17, 2018, 10:30pm

I’m going to investigate further.

Windows is checking a WLAN SSID when cable connected. This is probably a Windows bug but this might not affect many people because it requires the following to get the unnecessary alert:

Laptop - although it might be a problem on desktop with WLAN card.
Running Windows 7+.
With WLAN setup and enabled.
Connected with network cable.
Using GlassWire.

It may be possible to workaround the unnecessary alert by using the Windows API to check the type of disconnection when the connection is not WLAN and the network is still connected.

Remah · December 18, 2018, 1:49am

I’ve reset my network settings:
Settings
Network & Internet
Network Reset
Reset Now
follow the instructions and restart your computer

Now I’m going to turn off the DHCP network hint and see if those alerts disappear.

Incidentally, I couldn’t NET STOP DHCP because of a dependent service that couldn’t be stopped – instead I will restart Windows.:

Remah · December 19, 2018, 12:44am

This stopped the GlassWire alerts related to DHCP. It also converts the Windows event from information to an error when the router is switched or the connection to it is lost. This happens because Windows doesn’t use the cached WLAN profile to reconnect.

I’m not investigating any further as the other reasons for “Internet access changed” alerts are more reasonable:

Windows entering sleep mode.
Windows trying to switch the WLAN and Bluetooth devices into low-power mode which they don’t have because they are old.

P.S.
FYI, GlassWire is proving to be very accurate for “Internet connection is lost”. I’ve went back and looked at alerts that occur twice in the same minute, like in this screenshot:

In all the cases, the connection is actually being lost twice in the same minute. Here’s one example:

First alert:

Windows Task Scheduler wakes the computer
The time synchronization task runs.
Windows goes back to sleep.

Second alert:

But Windows wakes to handle an error when the Bluetooth device couldn’t be switched into low-power mode.
The Power Troubleshooter runs.
Windows goes back to sleep again.