The official user guide for GlassWire.
We built GlassWire to help our friends and family visually see what exactly their computers are doing over the Internet and regain control of their network activity, security, and privacy.
GlassWire is a network security tool that visualizes your past and present network activity on an easy to understand graph. The GlassWire tool alerts you to possible threats, manages your firewall, monitors remote servers, and helps anyone understand their network activity.
Install GlassWire to help protect your privacy, add an extra layer of security to your computers, and speed up your Internet access by removing or blocking applications that are wasting your bandwidth.Installation
Start by visiting https://glasswire.com/download/ and clicking the download button to download the GlassWire installer to your desktop. After downloading the GlassWire installer double click it and begin the installation process.
Click "Next" and follow the instructions in the installer to install the software. The licensing agreement will appear in the second window. If you agree check the box that says "I accept the terms" and then click "Next".
In the next window you can choose to add GlassWire to your Windows quick launch area as a shortcut, decide to add GlassWire as a desktop icon or not, and decide if GlassWire should run on startup or not. Press "Next" after making your decision on these options. We recommend letting GlassWire run on startup because it runs in the tray and won't take up any screen real estate after a reboot unless you choose to click it in the notification area. In the next window you can choose where you want to install GlassWire.
GlassWire also has the option to install the software as a clean install. If you choose this option you will lose all your GlassWire settings, but if you’re a paid user you should keep your paid status. This feature is good to try if you are running into technical problems with GlassWire.
There is also an option to reset the Windows Firewall. If you want to start fresh with GlassWire and you don’t want other app Windows Firewall settings to interact with GlassWire’s firewall settings you can choose this option. Please note if you don’t reset the Windows Firewall settings some apps may temporarily access the network while GlassWire is in “Ask to connect” mode due to the previous Windows Firewall API rules.
Once GlassWire is installed press "OK" to launch the application and begin using it."New" First Network Access Notifications
At first GlassWire may show you many "New" first network access notifications but as time goes by these notifications will not happen very frequently. We recommend keeping the GlassWire desktop notifications running so you'll be alerted to possible security problems or notice if a "new" application goes online that shouldn't be accessing the network at all. We will give instructions for changing notification settings or disabling them in the "Settings" part of the guide below.GlassWire Menu
When GlassWire appears after its installation there is a menu at the top left of the software that allows you to access many different features. Click the top left menu and you'll see a list of different options. "Hide GlassWire" minimizes the software. If you want to bring GlassWire back you can click its icon in the bottom right notification area of your computer.
The "Skin" feature allows you to choose different colors for your graph. Some colors make it easier to differentiate incoming bandwidth from outgoing, plus it's fun!
"Settings" can also be accessed via this menu. The GlassWire settings are discussed in detail later in this user guide.
"Snooze on" disables any desktop notifications for 24 hours. If you don't want to be disturbed for 24 hours by any GlassWire notifications then you can choose this option. If you want to turn GlassWire notifications on before 24 hours you can select this option again and GlassWire will begin to work normally again. If you dislike all notifications you can go to the GlassWire settings and view the "Client" tab and uncheck "Enable tray notifications".
"Incognito" mode causes GlassWire to no longer save a record of your network activity on the graph. It works similar to the Incognito mode in most modern web browsers where GlassWire does not keep a record of your network activity on the graph.
“Show Mini Viewer” shows you a small network monitor you can show on your desktop all the time. Click the mini viewer window to change its transparency, or resize it.
“Activate” or “Deactivate” GlassWire allows you to activate or deactivate a paid version of the GlassWire software.
The “Language” option allows you to choose your language option with GlassWire. For example you can change the language to Spanish or German, plus many other languages.
"Help" takes you to the online GlassWire help guide.
"About" shows the GlassWire about window with its version information. If someone asks you what version of GlassWire you are using you can find the info under "About".
The "Exit" option quits GlassWire. You can restart GlassWire by looking under the start menu or double click its icon on your desktop if you installed its icon there.Main GlassWire Window
Almost all the GlassWire features can be accessed via the main GlassWire window. The top left "Graph" tab shows your visualized network activity. The "Firewall" tab allows you to block or unblock applications from accessing the Internet. The "Usage" tab shows a summary of your network usage. The “Things” tab shows you all the devices connected to your network. The "Alerts" tab shows you any alerts you may have received from GlassWire.Graph Tab
The graph tab visualizes your present and past network activity. Choosing "All" at the top left shows all your network activity. Choose "Apps" to see your network activity by application and "Traffic" to see your network activity by traffic type. For example if you are sending a lot of ftp traffic then this traffic type (ftp) will be separated from your other types of traffic so you can see exactly how much ftp traffic you are sending or receiving.Things (Internet of Things)
Click the "Things" tab in the main GlassWire window to see a list of devices that are currently on your computer network or WiFi. The word “Things” refers to the “Internet of Things”, or devices that are connected to the network. This paid feature shows the manufacturer of the device on the network along with its IP and Mac address.
Go to GlassWire’s settings then choose “security” to turn on the “Things monitor”. You can now get notified whenever a new unknown device joins your network.Activating a paid GlassWire version
After buying GlassWire you can activate a paid version with extra features by going to the top left "GlassWire" menu and choosing the "Activate GlassWire" menu. Enter the correct serial number that you were sent after ordering the software and your GlassWire version will then automatically restart and upgrade. Please note that there is no separate paid version of GlassWire to download. You can activate the paid version of GlassWire directly from the free version we offer on our download page.Ask to connect
GlassWire's paid software "Ask to connect" mode allows you to allow or deny network connections. Go to the "Firewall" tab and choose "Ask to connect" in the pull-down menu to turn on this paid feature so you can allow or deny connections.Block all mode
Have you ever wanted to block all network access to your computer while you're away? This paid GlassWire feature is activated if you go to the "Firewall" tab and choose "Block all" in the pull-down menu. Now all network connections are blocked until you choose to unblock them with the same menu.Mini graph
Paid users can add a small mini graph to their desktop to see their network activity at all times. Go to the top left "GlassWire" menu and choose "Mini graph" to activate this feature. Drag the corners of the mini graph larger/smaller to change their size.Pausing and Snapshots
Mouse over the graph and a pause and snapshot icon will appear at the top right. Click the pause icon if you want to pause the graph. Once the graph is paused then the pause button will flash until you unpause by clicking it again.
The snapshot icon allows you to take a snapshot of your graph and save it to your desktop or share it on Twitter or Facebook. We really appreciate GlassWire fans spreading the word about our software #glasswire!Timeline and Sliders
At the top right of the "Graph" tab you can choose if you want to show the last 5 minutes of the graph, the last 3 hours, 24 hours, or the last week. Once you choose the time at the top right you can then grab and move the sliders on the bottom timeline anywhere on the graph you want to make it appear in the large main graph window. Dragging the sliders allows you to zoom in on a certain time period on the graph.
On the bottom timeline the small dots on the graph are GlassWire alerts. You can drag the sliders to zoom in on those alerts and see what they are on the big graph.
If you want a slower flowing graph then you can choose "3 hours" at the top right of the graph, then drag both sliders to as far right as possible. The previous option is my personal favorite time setting with GlassWire, but other people may prefer a more exciting fast moving graph. If that's the case click the "5 minutes" option at the top right of the graph and keep the sliders at the far right. This is GlassWire's default slider settings. If you want an extremely slow graph that doesn't even look like it's moving you can also choose 24 hours and then drag the sliders to a place you feel comfortable with. It may be useful to use a 24 hour graph on a server or some other computer you don't access very often, or to find and zoom in on strange spikes or specific alerts. Play around with GlassWire's sliders and time options, I promise you won't break anything.
You may notice that the small bottom timeline graph isn't always identical to the top large graph. This is due to scaling, however if you zoom in to a certain section of the graph with the sliders you'll see that the graphs look identical if you choose the exact same time periods.Idle Time and Clock Icon
On the graph you may see a dark section that includes a clock icon. These graphics mean your computer was idle when that network activity occurred. To disable idle mode go to the top left GlassWire menu and choose "Settings" then uncheck the "Start idle mode" box. We recommend leaving the idle settings running so you can tell if it was you who initiated network activity or if it happened while you were away from your computer.Clicking the Graph
If you see a large spike or something unusual on the GlassWire graph it's easy to figure out what happened. Mouse over the graph and click on the big spike in traffic or event you want to learn more information about. After you click the event the graph will automatically pause for you. To unpause the graph click the top right flashing pause icon or right click the graph and it will go back to animating normally. To remove the tracking line on the graph you can right click the graph one time and it will immediately disappear. Sometimes it's useful to leave the tracking line on the graph so you can see what's happening in detail in real time. When the graph activity passes the tracking line it will show some useful information directly below the graph.
Once you click an event on the graph and it's paused you will see that some application and host icons will appear directly under the large graph. Click these icons to see what applications were sending data during that event. Click the flag icon to see the servers that your computer was communicating with during that event. The flag represents the country of the network your computer was communicating with. If you see a flag you don't recognize you can mouse over it to see the country name. If you see a blue and white striped flag then it may mean the host country is unknown.
The hosts and apps are listed in order of how much bandwidth they used so it's easier to see what app or network was sending or receiving the bandwidth to cause the event to appear on the graph. You can also click on the app icon or host to find out more information about it. For example if Firefox is your app you can click its icon and see where it is installed on your system and its version number.Incoming/Outgoing Bandwidth and Scaling
Near the bottom on the left side of the graph there is a circle with an up arrow along with a separate colored circle with a down arrow. The up arrow color shows outgoing bandwidth color on the graph and the down arrow shows incoming bandwidth color. Going to the top left "GlassWire" menu and choosing "Skins" allows you to find a color that's easy for your eyes to see if you aren't happy with the default colors.
On the left side of the graph near the top you can see the scale of the graph. For example right now my graph shows a scale of 6Kb/s because I don't currently have much network activity going on while I write this document. However, if I begin to download a Youtube video or a big file the scale of the graph will change and it may show something like 3 Mb/s instead. The scale of your graph may change occasionally due to your current network usage but it's nothing to worry about, unless you don't know what you're downloading that's changing the scale. If that's the case click the graph by following the "Clicking the Graph" instructions above and figure out what you're downloading for peace of mind. That's why we made GlassWire, to help you understand what's happening with your network activity.Firewall Tab
There are lots of different firewall applications that are available but most of them use their own driver system and this can cause your computer to be unstable. GlassWire manages the built in Windows firewall to block or unblock applications so your operating system stays stable, secure, and reliable.
Go to the top Firewall tab in the main GlassWire window. The Apps column shows you what on your operating system is accessing the Internet. The hosts column shows who or what the app is communicating with. The up/down arrow column shows a graph of what the app has been doing over a long time period.
There is also a “VirusTotal” column if you want to check your connected apps with VirusTotal.com (this feature is off by default and must be turned on in GlassWire’s settings).
At the top of the menu you can turn the GlassWire firewall on or off. Please note this does not turn off your Windows firewall. To block an app click the fire icon to the left of the application icon. For example with Firefox you would click the fire icon to the left of the Firefox icon. Now the fire icon has turned red and Firefox is blocked from accessing the Internet. Click the fire icon again to allow Firefox to access the Internet again.
If you want to unblock all your blocked apps at once then go to the top left and choose "Firewall off" then choose the same menu again to turn it back on.
To see more information about the application that you plan to block you can click on its icon. You can also do the same with the Hosts column. If you cannot use the Firewall tab at all then you may see an error message that lets you know your Windows Firewall is disabled at the operating system level. This is something that happened with your operating system and has nothing to do with GlassWire. GlassWire cannot disable your Windows firewall or re-enable it.
After the firewall is turned on you can use “Click to block” mode, “Ask to connect” mode, or “Block all” mode. “Click to block” mode lets all connections through, but allows you to later block connections you don’t like. “Ask to connect” will alert you before a connection starts and lets you allow or deny the connection, and “Block all” mode should block all network connections on your PC.
In the center of the firewall window is the “Firewall Profiles” option. You can create and save a firewall profile depending on your location, or how you use your device. For example, you can turn on “Ask to connect” mode and deny everything but Internet Explorer so nothing else accesses the network. You can then use this profile while you’re on a metered Internet connection to save data usage.Usage Tab
The usage tab shows you visually what apps, hosts, and traffic types are using up most of your bandwidth. This feature allows you to figure out how much bandwidth your computer is using every month. If you want to keep tabs on how much bandwidth you are using you can go to the "All Usage" column on the left side and click the "Options" menu with the down arrow and then choose "usage alerts". You can then choose to get an alert once you get close to going over your monthly bandwidth allocation. Please keep in mind that the usage tab only shows the network activity for the specific computer you have GlassWire installed on and nothing else. For example if you have an Xbox or Apple TV set up somewhere else in your house then that bandwidth is not monitored or counted with these statistics, therefore you could go over your bandwidth usage due to those separate devices.
Go to the "Options" text again and choose its pull-down menu to choose different bandwidth tracking options. For external and local you can choose to only show external traffic, or only show local, or show both. Local traffic is usually caused by computers talking with each other on your local network or your computer communicating with your local printer. Usually this local bandwidth doesn't count as part of your service provider allowance and usually this local bandwidth is minimal.
The usage tab allows you to break down traffic by all types, app types, and traffic types similar to the main graph window. You can also go to the middle top of the UI and pick a specific date you want to show data, or go to the far right and choose month, week, or day. The bottom slider works similar to the slider that is explained in the "Timeline and Sliders" section of this user guide in the section above.Alerts Tab
GlassWire alerts let you know about important network related events that may affect your computer. Go to the main GlassWire window and then click the "Alerts" tab to view your alerts. At the top left of the window you can sort your alerts by date, apps, and type of alert. If you have an alert with a number on it on the alerts tab you can click the tab one time to make the number disappear. You can also see under the alerts tab what alerts have been read or not by their color. To mark all alerts as read you can click the "mark all as read" button at the top right of the window.
The "New" or "First Network Access" alert lets you know when a new application is accessing the Internet. When you first install GlassWire you will receive many of these "new" alerts while GlassWire learns what applications on your system normally use the Internet. These "new" alerts will become rare over time. These first network access alerts are useful because if you suddenly receive a "new" alert from an application that shouldn't normally access the Internet or from an application you don't remember installing it could be a privacy or security issue. You can then check the alert in detail and see what application is accessing the Internet, review who or what the app is communicating with, then decide to block it via the Firewall or take some other action.
There are many different GlassWire alerts.
New Application Monitor – Alerts you every time a new application is accessing the Internet or network.
System File Changed – Alerts you to a system file that has changed that is network related.
Device List Change – Alerts you to any network related devices on your system that were changed.
Application Info Monitor – Alerts you to changes with any applications that access the Internet that could be caused by tampering with your computer.
While You Were Away – Gives you a summary of what network activity occurred on your computer while you were away or while your computer was idle.
ARP Spoofing – Looks for and reports ARP spoofing. ARP spoofing may allow an attacker to intercept data, modify your Internet traffic, or stop your traffic all together.
Traffic Monitor – Go to the "Usage" tab and click the "Options" on the left side to set an alert once you hit a certain bandwidth level.
Proxy Monitor – Alert you to proxy use or changes.
DNS Settings – Alerts you to DNS changes on your system.
Internet Access Monitor – Alerts you to Internet access changes on your system.
Remote Client Connection – If you enable the remote access feature this alert lets you know when you connect to your server or computer remotely with GlassWire. Remote monitoring is popular with GlassWire users who manage remote servers for work, gaming, etc…
Suspicious Hosts – GlassWire keeps an up to date list of known suspicious hosts and alerts you if you contact one. Suspicious hosts are often related to botnets, malware, and other malicious behavior.
Things Monitor – Get alerted when a new unknown device joins your network, or know what a device goes on/offline.
WiFi Evil Twin – Know when a new WiFi access point appears with your current access point’s name. Or also know when your WiFi access point loses its password.Remote Monitoring
You can use GlassWire to monitor remote servers or other computers that you control. You must run GlassWire on your local monitoring PC and on every remote PC or server that you want to monitor. Remote monitoring is turned off by default and can only be turned on with your administrator password. Also GlassWire alerts you if you receive a remote GlassWire connection.
Remoting Out – To remote out and connect to another computer or server go to the "Server List" tab in the settings. The settings can be accessed by going to the top left "GlassWire" menu and choosing "Settings". Next click "Server List" then put in the Name (you can name it whatever you want), the computer IP address or host name, and password that you set up with GlassWire. Once you are connected the remote server's network activity will appear via the GlassWire graph window and you can monitor your server or computer remotely. On the remote PC you plan to connect to, follow the instructions below so you can connect to it.
Allowing Remote Access – To allow someone to remotely monitor your computer or server with GlassWire you must go to the GlassWire settings then choose the "Server" tab. Next, click the "Remote Access" option and click "Unlock" and type in your operating system admin password to turn on this feature. You can then choose to allow remote access to the server or PC you want to monitor and put in a password. For extra security we recommend you only allow access from your IP address if it's a static one that doesn't change often.
Custom Ports - You can also change the port you prefer to use on the remote PC under the "Server List" tab in GlassWire settings, then under "General". If you use our default port :7010 then you do not need to add anything after the remote PC IP address, however if you set a different port on the remote PC you should enter :XXXX where XXXX is the port you set on the remote PC settings.
If your remote PC is behind a router and you cannot connect you may have to turn on port forwarding with your router, or you could use a third party service like Ngrok or Hamachi. Try doing a search for your router name and "port forward" to find instructions on how to turn on port forwarding for your remote PC. Please note Ngrok or Hamachi may not be recommended for some types of secure networks, so if you're considering them in a business environment please discuss using those products with your local IT professional before trying them.Port Forwarding
If GlassWire is running behind a router you may want to use the Port Forwarding feature of your router to enable remote connections.
You will need to forward the traffic from the router's public IP address to the computer's IP address, where GlassWire is running. Please refer to your router documentation to know how Port Forwarding may be configured. Also check your router firewall settings to make sure that it is allowed to accept the incoming connections.Settings
To access the GlassWire settings go to the top left "GlassWire" menu and choose "Settings". You are now under the "Client" tab in the settings.
The "start idle mode" allows you to choose if GlassWire will detect if your computer is idle or not and show that info on the graph. Showing your computer is idle on the graph is useful because if you notice strange network activity while you were idle then you will probably want to investigate what happened during that time period.
"Run on startup" makes GlassWire start when you start up your computer.
"Enable tray notifications" allows tray alerts to temporarily appear on your computer desktop and alert you to possible problems. If you only need to disable these notifications temporarily you can go to the top left GlassWire menu in the main window and choose "snooze alerts".
"Enable admin account password request" keeps GlassWire more secure by only allowing changes to GlassWire if you have your admin password. Otherwise anyone who has access to your computer could easily change your GlassWire settings any time.
"Skins" allow you to pick different colors for your graph.
"Clear history" lets you to easily delete your graph history. We never have access to your graph history and your graph history is only stored locally on your computer.
The "Security" tab has a list of security related alerts you can enable or disable. If you want to disable the alerts that appear on your desktop then you can disable them under "Enable tray notifications" under the "Client" tab. Disabling alerts under "Security" turns off the security alert permanently where you won't be alerted to malicious behavior in GlassWire at all. We recommend keeping these security alerts on unless you're receiving what you think is a false alarm. If you think you're receiving a false alarm please report it to our helpdesk so we can investigate.VirusTotal
The VirusTotal API inside GlassWire is turned off by default. If you'd like to try VirusTotal inside GlassWire please go to the top left GlassWire menu and choose "settings" then click "VirusTotal". Only Windows users with admin access should be able to turn on the VirusTotal API setting.
VirusTotal checks suspicious software samples with several antivirus solutions and helps antivirus labs by forwarding them the malware they fail to detect. VirusTotal is not an antivirus and should not be treated as one. GlassWire itself may occasionally be flagged as malware by VirusTotal as a false positive. If you have any concerns about this please email us, or post in our forum so we can help you investigate.
To analyze a file with VirusTotal go to GlassWire's Firewall tab, then mouse over the "VirusTotal" column and click "Analyze" on the file you want analyzed. Please note, uploading files to VirusTotal will use some network activity and you should use caution if you are on a metered or limited connection.
Once you analyzed the file you can click the file name to see the results on VirusTotal.com.
If the VirusTotal API is turned on VirusTotal cannot see your GlassWire network activity, but VirusTotal can see any files you choose to analyze.
If you'd like to check all your network related files with VirusTotal all the time and you have no concerns about uploading any network related files to VirusTotal you can choose the API setting "Automatically analyze all apps with network activity with VirusTotal." Now all your network related files will be automatically checked by VirusTotal and you can check them all any time under the GlassWire "Firewall" tab.
If you try to upload too many files to VirusTotal at a time there could be a delay while your files are checked. Please be patient as your files enter a queue and are checked one by one by VirusTotal.
To turn off the VirusTotal API features go back to GlassWire's settings menu and uncheck the features you no longer want to use, then lock the settings.Moving the GlassWire Database
If you'd like to move your GlassWire database to a different hard drive you can do so by following these instructions.
To move your GlassWire graph database please create a "glasswire.conf" file in notepad with this line only, or edit your current glasswire.conf file in
This file should be copied to the
The database path is set to
D:\GlassWire\ folder in the file sample, but you can change the path to something else.
You should restart the GlassWire service when the file is copied.Backup all GlassWire Settings & Database
If you need to do a clean install of GlassWire but don't want to lose your settings or graph data it's possible to backup your data, then restore it.
Now it's time to restore your settings and GlassWire graph database.
If you need to do a clean install of GlassWire and you don't want to lose your graph data and settings, but you moved your database from its default location please try these instructions.
Backup instructions (if you have moved your database):
C:\ProgramData\GlassWire\service\glasswire.conf, db_file_path option. For example, it's value is
Restore instructions (if you have manually moved your database):
To remove GlassWire go to Add/Remove programs by going to the main Windows control panel and then choosing "Uninstall a program".