GlassWire Network Security Monitor
Firewall &
Network Monitor

User Guide

Learn how to use GlassWire in detail.

GlassWire Network Security Monitor

We built GlassWire to help our friends and family visually see what exactly their computers are doing over the Internet and regain control of their network activity, security, and privacy.

GlassWire is a network security tool that visualizes your past and present network activity on an easy to understand graph. The GlassWire tool alerts you to possible threats, manages your firewall, monitors remote servers, and helps anyone understand their network activity.

Install GlassWire to help protect your privacy, add an extra layer of security to your computers, and speed up your Internet access by removing or blocking applications that are wasting your bandwidth.

Installation

"New" First Network Access Notifications

GlassWire Menu

Main GlassWire Window

Graph Tab

Network Tab

Activating a paid GlassWire version

Webcam & Mic Usage

Ask to connect

Block all mode

Mini graph

Pausing and Snapshots

Timeline and Sliders

Idle Time and Clock Icon

Clicking the Graph

Incoming/Outgoing Bandwidth and Scaling

Firewall Tab

Usage Tab

Alerts Tab

Third Party Virus Scanning

Remote Monitoring

Port Forwarding

Settings

Uninstall GlassWire

Installation

Start by visiting https://glasswire.com/download/ and clicking the download button to download the GlassWire installer to your desktop. After downloading the GlassWire installer double click it and begin the installation process.

Click "Next" and follow the instructions in the installer to install the software. The licensing agreement will appear in the second window. If you agree check the box that says "I accept the terms" and then click "Next".

In the next window you can choose to add GlassWire to your Windows quick launch area as a shortcut, decide to add GlassWire as a desktop icon or not, and decide if GlassWire should run on startup or not. Press "Next" after making your decision on these options. We recommend letting GlassWire run on startup because it runs in the tray and won't take up any screen real estate after a reboot unless you choose to click it in the notification area. In the next window you can choose where you want to install GlassWire.

Once GlassWire is installed press "OK" to launch the application and begin using it.

"New" First Network Access Notifications

At first GlassWire may show you many "New" first network access notifications but as time goes by these notifications will not happen very frequently. We recommend keeping the GlassWire desktop notifications running so you'll be alerted to possible security problems or notice if a "new" application goes online that shouldn't be accessing the network at all. We will give instructions for changing notification settings or disabling them in the "Settings" part of the guide below.

GlassWire Menu

When GlassWire appears after its installation there is a menu at the top left of the software that allows you to access many different features. Click the top left menu and you'll see a list of different options. "Hide GlassWire" minimizes the software. If you want to bring GlassWire back you can click its icon in the bottom right notification area of your computer.

The "Skin" feature allows you to choose different colors for your graph. Some colors make it easier to differentiate incoming bandwidth from outgoing, plus it's fun!

"Settings" can also be accessed via this menu. The GlassWire settings are discussed in detail later in this user guide.

"Snooze on" disables any desktop notifications for 24 hours. If you don't want to be disturbed for 24 hours by any GlassWire notifications then you can choose this option. If you want to turn GlassWire notifications on before 24 hours you can select this option again and GlassWire will begin to work normally again. If you dislike all notifications you can go to the GlassWire settings and view the "Client" tab and uncheck "Enable tray notifications".

"Incognito" mode causes GlassWire to no longer save a record of your network activity on the graph. It works similar to the Incognito mode in most modern web browsers where GlassWire does not keep a record of your network activity on the graph.

"Help" takes you to the online GlassWire help guide.

"About" shows the GlassWire about window with its version information. If someone asks you what version of GlassWire you are using you can find the info under "About".

The "Exit" option quits GlassWire. You can restart GlassWire by looking under the start menu or double click its icon on your desktop if you installed its icon there.

Main GlassWire Window

Almost all the GlassWire features can be accessed via the main GlassWire window. The top left "Graph" tab shows your visualized network activity. The "Firewall" tab allows you to block or unblock applications from accessing the Internet. The "Usage" tab shows a summary of your network usage. The "Alerts" tab shows you any alerts you may have received from GlassWire.

Graph Tab

The graph tab visualizes your present and past network activity. Choosing "All" at the top left shows all your network activity. Choose "Apps" to see your network activity by application and "Traffic" to see your network activity by traffic type. For example if you are sending a lot of ftp traffic then this traffic type (ftp) will be separated from your other types of traffic so you can see exactly how much ftp traffic you are sending or receiving.

Network Tab

Click the "Network" tab in the main GlassWire window to see a list of devices that are currently on your computer network or WiFi. This paid feature shows the manufacturer of the device on the network along with its IP and Mac address.

Activating a paid GlassWire version

After buying GlassWire you can activate a paid version with extra features by going to the top left "GlassWire" menu and choosing the "Activate GlassWire" menu. Enter the correct serial number that you were sent after ordering the software and your GlassWire version will then automatically restart and upgrade. Please note that there is no separate paid version of GlassWire to download. You can activate the paid version of GlassWire directly from the free version we offer on our download page.

Webcam & Mic Usage

Have you ever been curious about what network accessible applications are accessing your webcam and mic and do you want to be notified when your mic/webcam are accessed? The paid versions of GlassWire can notify you when your webcam and mic is used and let you know what network accessible application is accessing it. After upgrading to a paid version of GlassWire go to the top left GlassWire menu and choose "Settings" to activate this feature if it's not already activated. Under the "Security" tab in settings click the "Device usage monitor" checkbox so it's turned on. Please note if an app does not access the network GlassWire will not notify you.

Ask to connect

GlassWire's paid software "Ask to connect" mode allows you to allow or deny network connections. Go to the "Firewall" tab and choose "Ask to connect" in the pull-down menu to turn on this paid feature so you can allow or deny connections.

Block all mode

Have you ever wanted to block all network access to your computer while you're away? This paid GlassWire feature is activated if you go to the "Firewall" tab and choose "Block all" in the pull-down menu. Now all network connections are blocked until you choose to unblock them with the same menu.

Mini graph

Paid users can add a small mini graph to their desktop to see their network activity at all times. Go to the top left "GlassWire" menu and choose "Mini graph" to activate this feature. Drag the corners of the mini graph larger/smaller to change their size.

Pausing and Snapshots

Mouse over the graph and a pause and snapshot icon will appear at the top right. Click the pause icon if you want to pause the graph. Once the graph is paused then the pause button will flash until you unpause by clicking it again.

The snapshot icon allows you to take a snapshot of your graph and save it to your desktop or share it on Twitter or Facebook. We really appreciate GlassWire fans spreading the word about our software #glasswire!

Timeline and Sliders

At the top right of the "Graph" tab you can choose if you want to show the last 5 minutes of the graph, the last 3 hours, 24 hours, or the last week. Once you choose the time at the top right you can then grab and move the sliders on the bottom timeline anywhere on the graph you want to make it appear in the large main graph window. Dragging the sliders allows you to zoom in on a certain time period on the graph.

On the bottom timeline the small dots on the graph are GlassWire alerts. You can drag the sliders to zoom in on those alerts and see what they are on the big graph.

If you want a slower flowing graph then you can choose "3 hours" at the top right of the graph, then drag both sliders to as far right as possible. The previous option is my personal favorite time setting with GlassWire, but other people may prefer a more exciting fast moving graph. If that's the case click the "5 minutes" option at the top right of the graph and keep the sliders at the far right. This is GlassWire's default slider settings. If you want an extremely slow graph that doesn't even look like it's moving you can also choose 24 hours and then drag the sliders to a place you feel comfortable with. It may be useful to use a 24 hour graph on a server or some other computer you don't access very often, or to find and zoom in on strange spikes or specific alerts. Play around with GlassWire's sliders and time options, I promise you won't break anything.

You may notice that the small bottom timeline graph isn't always identical to the top large graph. This is due to scaling, however if you zoom in to a certain section of the graph with the sliders you'll see that the graphs look identical if you choose the exact same time periods.

Idle Time and Clock Icon

On the graph you may see a dark section that includes a clock icon. These graphics mean your computer was idle when that network activity occurred. To disable idle mode go to the top left GlassWire menu and choose "Settings" then uncheck the "Start idle mode" box. We recommend leaving the idle settings running so you can tell if it was you who initiated network activity or if it happened while you were away from your computer.

Clicking the Graph

If you see a large spike or something unusual on the GlassWire graph it's easy to figure out what happened. Mouse over the graph and click on the big spike in traffic or event you want to learn more information about. After you click the event the graph will automatically pause for you. To unpause the graph click the top right flashing pause icon or right click the graph and it will go back to animating normally. To remove the tracking line on the graph you can right click the graph one time and it will immediately disappear. Sometimes it's useful to leave the tracking line on the graph so you can see what's happening in detail in real time. When the graph activity passes the tracking line it will show some useful information directly below the graph.

Once you click an event on the graph and it's paused you will see that some application and host icons will appear directly under the large graph. Click these icons to see what applications were sending data during that event. Click the flag icon to see the servers that your computer was communicating with during that event. The flag represents the country of the network your computer was communicating with. If you see a flag you don't recognize you can mouse over it to see the country name. If you see a blue and white striped flag then it may mean the host country is unknown.

The hosts and apps are listed in order of how much bandwidth they used so it's easier to see what app or network was sending or receiving the bandwidth to cause the event to appear on the graph. You can also click on the app icon or host to find out more information about it. For example if Firefox is your app you can click its icon and see where it is installed on your system and its version number.

Incoming/Outgoing Bandwidth and Scaling

Near the bottom on the left side of the graph there is a circle with an up arrow along with a separate colored circle with a down arrow. The up arrow color shows outgoing bandwidth color on the graph and the down arrow shows incoming bandwidth color. Going to the top left "GlassWire" menu and choosing "Skins" allows you to find a color that's easy for your eyes to see if you aren't happy with the default colors.

On the left side of the graph near the top you can see the scale of the graph. For example right now my graph shows a scale of 6Kb/s because I don't currently have much network activity going on while I write this document. However, if I begin to download a Youtube video or a big file the scale of the graph will change and it may show something like 3 Mb/s instead. The scale of your graph may change occasionally due to your current network usage but it's nothing to worry about, unless you don't know what you're downloading that's changing the scale. If that's the case click the graph by following the "Clicking the Graph" instructions above and figure out what you're downloading for peace of mind. That's why we made GlassWire, to help you understand what's happening with your network activity.

Firewall Tab

There are lots of different firewall applications that are available but most of them use their own driver system and this can cause your computer to be unstable. GlassWire manages the built in Windows firewall to block or unblock applications so your operating system stays stable, secure, and reliable.

Go to the top Firewall tab in the main GlassWire window. The Apps column shows you what on your operating system is accessing the Internet. The hosts column shows who or what the app is communicating with. The up/down arrow column shows a graph of what the app has been doing over a long time period.

At the top of the menu you can turn the GlassWire firewall on or off. Please note this does not turn off your Windows firewall. To block an app click the fire icon to the left of the application icon. For example with Firefox you would click the fire icon to the left of the Firefox icon. Now the fire icon has turned red and Firefox is blocked from accessing the Internet. Click the fire icon again to allow Firefox to access the Internet again.

If you want to unblock all your blocked apps at once then go to the top left and choose "Firewall off" then choose the same menu again to turn it back on.

To see more information about the application that you plan to block you can click on its icon. You can also do the same with the Hosts column. If you cannot use the Firewall tab at all then you may see an error message that lets you know your Windows Firewall is disabled at the operating system level. This is something that happened with your operating system and has nothing to do with GlassWire. GlassWire cannot disable your Windows firewall or re-enable it. That's something you have to do yourself. Good luck and happy blocking!

Usage Tab

The usage tab shows you visually what apps, hosts, and traffic types are using up most of your bandwidth. This feature allows you to figure out how much bandwidth your computer is using every month. If you want to keep tabs on how much bandwidth you are using you can go to the "All Usage" column on the left side and click the "Options" menu with the down arrow and then choose "usage alerts". You can then choose to get an alert once you get close to going over your monthly bandwidth allocation. Please keep in mind that the usage tab only shows the network activity for the specific computer you have GlassWire installed on and nothing else. For example if you have an Xbox or Apple TV set up somewhere else in your house then that bandwidth is not monitored or counted with these statistics, therefore you could go over your bandwidth usage due to those separate devices.

Go to the "Options" text again and choose its pull-down menu to choose different bandwidth tracking options. For external and local you can choose to only show external traffic, or only show local, or show both. Local traffic is usually caused by computers talking with each other on your local network or your computer communicating with your local printer. Usually this local bandwidth doesn't count as part of your service provider allowance and usually this local bandwidth is minimal.

The usage tab allows you to break down traffic by all types, app types, and traffic types similar to the main graph window. You can also go to the middle top of the UI and pick a specific date you want to show data, or go to the far right and choose month, week, or day. The bottom slider works similar to the slider that is explained in the "Timeline and Sliders" section of this user guide in the section above.

Alerts Tab

GlassWire alerts let you know about important network related events that may affect your computer. Go to the main GlassWire window and then click the "Alerts" tab to view your alerts. At the top left of the window you can sort your alerts by date, apps, and type of alert. If you have an alert with a number on it on the alerts tab you can click the tab one time to make the number go away. You can also see under the alerts tab what alerts have been read or not by their color. To mark all alerts as read you can click the "mark all as read" button at the top right of the window.

The "New" or "First Network Access" alert lets you know when a new application is accessing the Internet. When you first install GlassWire you will receive many of these "new" alerts while GlassWire learns what applications on your system normally use the Internet. These "new" alerts will become rare over time. These first network access alerts are useful because if you suddenly receive a "new" alert from an application that shouldn't normally access the Internet or from an application you don't remember installing it could be a privacy or security issue. You can then check the alert in detail and see what application is accessing the Internet, review who or what the app is communicating with, then decide to block it via the Firewall or take some other action.

There are many different GlassWire alerts.

New Application Monitor – Alerts you every time a new application is accessing the Internet or network.

System File Changed – Alerts you to a system file that has changed that is network related.

Device List Change – Alerts you to any network related devices on your system that were changed.

Application Info Monitor – Alerts you to changes with any applications that access the Internet that could be caused by tampering with your computer.

While You Were Away – Gives you a summary of what network activity occurred on your computer while you were away or while your computer was idle.

ARP Spoofing – Looks for and reports ARP spoofing. ARP spoofing may allow an attacker to intercept data, modify your Internet traffic, or stop your traffic all together.

Traffic Monitor – Go to the "Usage" tab and click the "Options" on the left side to set an alert once you hit a certain bandwidth level.

Proxy Monitor – Alert you to proxy use or changes.

DNS Settings – Alerts you to DNS changes on your system.

Internet Access Monitor – Alerts you to Internet access changes on your system.

Remote Client Connection – If you enable the remote access feature this alert lets you know when you connect to your server or computer remotely with GlassWire. Remote monitoring is popular with GlassWire users who manage remote servers for work, gaming, etc…

Suspicious Hosts – GlassWire keeps an up to date list of known suspicious hosts and alerts you if you contact one. Suspicious hosts are often related to botnets, malware, and other malicious behavior.

Third Party Virus Scanning

GlassWire works with your antivirus scanner to check for viruses or malware. Did a "New" application just begin accessing the Internet and you don't know what it is? Click the "scan" button next to it and let your antivirus check it out. Be sure your antivirus is up to date before scanning.

If you still aren't sure if the application is safe or not sometimes it's useful to upload it to VirusTotal.

Remote Monitoring

You can use GlassWire to monitor remote servers or other computers that you control. You must run GlassWire on your local monitoring PC and on every remote PC or server that you want to monitor. Remote monitoring is turned off by default and can only be turned on with your administrator password. Also GlassWire alerts you if you receive a remote GlassWire connection.

Remoting Out – To remote out and connect to another computer or server go to the "Client" tab in the settings. The settings can be accessed by going to the top left "GlassWire" menu and choosing "Settings". Next click "Remote Server" then put in the Name (you can name it whatever you want), the computer IP address or host name, and password that you set up with GlassWire. Once you are connected the remote server's network activity will appear via the GlassWire graph window and you can monitor your server or computer remotely.

Allowing Remote Monitoring – To allow someone to remotely monitor your computer or server you must go to the GlassWire settings then choose the "Server" tab. Next, click the "Remote Access" option and click "Unlock" and type in your operating system password to turn on this feature. You can then choose to allow remote access to the server and put in a password. For extra security we recommend you only allow access from your IP address if it's a static one that doesn't change often.

Getting Connected

Your Remote PC:
  1. First go to the top left GlassWire menu and open settings\server\remote access;
  2. Check the box "Allow remote access by password";
  3. Click "Change password" and set the new password. Try making the password simple for the first connection only, to be sure you don't have a typo.
  4. Click OK;
  5. Open settings\server\general and make sure that the "Remote access state" is "Allowed"

Custom Ports - You can also change the port you prefer to use on the remote PC under the "Server" tab in GlassWire settings, then under "General". If you use our default port :7010 then you do not need to add anything after the remote PC IP address, however if you set a different port on the remote PC you should enter :XXXX where XXXX is the port you set on the remote PC settings.

Local PC (the PC from which we are going to connect to the remote PC from):
  1. Open Settings\Client\Remote server;
  2. Click "Add new server" and select it on the "Server list";
  3. Type the name of the server;
  4. Type the IP address of the remote server; Go to www.whatismyip.com from the remote server if you're not sure what its IP is. Next enter the IP address of your remote server. Please see the note above about "Custom Ports" if you use one.

If your remote PC is behind a router and you cannot connect you may have to turn on port forwarding with your router, or you could use a third party service like Ngrok or Hamachi. Try doing a search for your router name and "port forward" to find instructions on how to turn on port forwarding for your remote PC. Please note Ngrok or Hamachi may not be recommended for some types of secure networks, so if you're considering them in an business environment please discuss using those products with your local IT professional before trying them.

Port Forwarding

If GlassWire is running behind a router you may want to use the Port Forwarding feature of your router to enable remote connections.

You will need to forward the traffic from the router's public IP address to the computer's IP address, where GlassWire is running. Please refer to your router documentation to know how Port Forwarding may be configured. Also check your router firewall settings to make sure that it is allowed to accept the incoming connections.

Settings

To access the GlassWire settings go to the top left "GlassWire" menu and choose "Settings". You are now under the "Client" tab in the settings.

The "start idle mode" allows you to choose if GlassWire will detect if your computer is idle or not and show that info on the graph. Showing your computer is idle on the graph is useful because if you notice strange network activity while you were idle then you will probably want to investigate what happened during that time period.

"Run on startup" makes GlassWire start when you start up your computer.

"Enable tray notifications" allows tray alerts to temporarily appear on your computer desktop and alert you to possible problems. If you only need to disable these notifications temporarily you can go to the top left GlassWire menu in the main window and choose "snooze alerts".

"Enable admin account password request" keeps GlassWire more secure by only allowing changes to GlassWire if you have your admin password. Otherwise anyone who has access to your computer could easily change your GlassWire settings any time.

"Skins" allow you to pick different colors for your graph.

"Clear history" lets you to easily delete your graph history. We never have access to your graph history and your graph history is only stored locally on your computer.

The "Security" tab has a list of security related alerts you can enable or disable. If you want to disable the alerts that appear on your desktop then you can disable them under "Enable tray notifications" under the "Client" tab. Disabling alerts under "Security" turns off the security alert permanently where you won't be alerted to malicious behavior in GlassWire at all. We recommend keeping these security alerts on unless you're receiving what you think is a false alarm. If you think you're receiving a false alarm please report it to our helpdesk so we can investigate.

Uninstall GlassWire

To remove GlassWire go to Add/Remove programs by going to the main Windows control panel and then choosing "Uninstall a program".