Hughesnet Community

Using Glasswire to determine a "Leak" (in this case a gusher)

cancel
Showing results for 
Search instead for 
Did you mean: 
williamtobler
New Member

Using Glasswire to determine a "Leak" (in this case a gusher)

With permission, I'd like to start a new thread about GlassWire if I may.  Now this isn't really about Hughes, because I have two ISPs, and the event that I am going to describe briefly here was when I was connected with my uncapped and no limit DSL (but Hughes upload/download speed is higher).

I purchased GlassWire Pro around 4 months ago (I think Amanda suggested Glasswire Free), and I was recently looking back at the history.  I was astonished to find an upload of 750GB (yes gigabyte, and about 10 months of Hughes quota) that as far as I was concerned was unauthorized, unknown, and went to an unknown destination.  Basically, it was my network drive that my personal data drive is backed up on regularly, using Acronis 2016.  Since then, there have been additional uploads after an incremental backup is performed.

I have tried real hard to sort this out including posting at Microsoft, but I have run out of gas and ideas.  One I want to stop it, and two I would like to know where it came from.

Glasswire indicates that the App is "System", the Host is my Seagate 41257D network attached drive, and the Traffic Type is Microsoft-DS Active Directory.

Microsoft told me to disable the Microsoft-DS Active Directory service, but I didn't find any such service to disable.  This is Windows 10.

And this is relevant to Hughes because of the frequent complaints about data leaks.


Gabe has already suggested some possible leak to the Cloud.  Certainly fits this IMO, but I have always said NO! to Cloud services and have not been able to find any signs of this on my computer.  I haven't found any services that would fit, and also have looked at the Scheduler and haven't found anything.  So far, it hasn't run often, but when it does it is fast and furious.  The uploads seem to be tracking the backups to the Seagate drive in both size and frequency.

38 REPLIES 38
GabeU
Distinguished Professor IV

You said it's a network drive, so it's a backup drive, right, as in a separate drive? Is it external? Have you checked if the 750GB is nothing more than the transfer to the backup drive, as in internal (not to the internet, but to the drive)?  
williamtobler
New Member

I posted on the OneDrive forum site, but was told that OneDrive doesn't use Microsoft-DS Active Directory.  I also didn't sign up for OneDrive, but Microsoft did it anyway.  The OneDrive folders on my computer are empty, as are the folders on my OneDrive account (that I said NO to).


BirdDog
Assistant Professor

William, did you install any kind of Seagate software that came with the drive and might have cloud backup automatically enabled?

No idea when it comes to 10 issues, 8.1 here.
williamtobler
New Member

It is an Ethernet external 3TB drive that I use only for backups.  I don't think the Glasswire report was on the same date but I can check that, and will.  Glasswire shows downloads and uploads, and what it is reporting is a 750 GB upload.  The 750 GB value is similar to the size of the full backup.  So let me go check this and get back.  Hopefully this is just a misinterpretation on my part of the Glasswire reports.


GabeU
Distinguished Professor IV

Can you post a snapshot of Glasswire where you can see this?  
GabeU
Distinguished Professor IV

I'd be willing to bet that what Glasswire is doing is counting the traffic between your system and the networked backup drive.  That's a HUGE amount of uploaded data, and more than what Hughesnet even offers for data in four months.  
williamtobler
New Member

Not that I did intentionally.  I just plugged it into the switch a year or more ago, and it did what it wanted through the 8.1 "upgrade" and the win10 "upgrade".

Last week I learned that I had to map the drive with Windows navigator in order to see the usual directory numbers (utilization).


williamtobler
New Member

This is one:

williamtobler
New Member

If Glasswire is just reporting a transfer from my internal drive to my Ethernet attached external drive, then all is well.  I am trying to confirm the size and dates now.


BirdDog
Assistant Professor

Like Gabe said, no way that is internet traffic, has to be local.
GabeU
Distinguished Professor IV

Yep, it's what I thought....



It's local, not internet traffic.  

Glasswire is simply counting the data that is being transferred between your system and your external drive.  
 
C0RR0SIVE
Associate Professor

Notice, Local vs External... The traffic isn't hitting your WAN, it's staying local to your network... As in, that's how much data has been sent from your computer, to the NAS.
williamtobler
New Member

I run Acronis 2016 to do these backups, which is a full backup followed by 5 incremental backups.  Then the cycle repeats.  The backups are done weekly on Wednesdays.


BirdDog
Assistant Professor

I have a router that monitors internet use so I don't use Glasswire. Would think there is a setting to separate local use or eliminate reporting it. 
GabeU
Distinguished Professor IV

williamtobler, 

Up above where it shows the graph wheel, there's an options pulldown.  You can change it to show only external to eliminate showing what doesn't count, ISP data wise.  
 
williamtobler
New Member

How would Glasswire distinguish with its jargon between this and that?
GabeU
Distinguished Professor IV

The options above the graph wheel.  Change it to external and it will show only internet traffic.  
williamtobler
New Member

 
williamtobler
New Member

If it is reporting all internet outgoing traffic over the period of Aug 28 to Jan 1, the number of 4.4GB is believable.  I post videos of our Township Board meetings.


GabeU
Distinguished Professor IV

You got it.  I see that with the paid version you can see a year's worth.  The free version gives a month.