Hughesnet Community

Using Glasswire to determine a "Leak" (in this case a gusher)

cancel
Showing results for 
Search instead for 
Did you mean: 
williamtobler
New Member

Using Glasswire to determine a "Leak" (in this case a gusher)

With permission, I'd like to start a new thread about GlassWire if I may.  Now this isn't really about Hughes, because I have two ISPs, and the event that I am going to describe briefly here was when I was connected with my uncapped and no limit DSL (but Hughes upload/download speed is higher).

I purchased GlassWire Pro around 4 months ago (I think Amanda suggested Glasswire Free), and I was recently looking back at the history.  I was astonished to find an upload of 750GB (yes gigabyte, and about 10 months of Hughes quota) that as far as I was concerned was unauthorized, unknown, and went to an unknown destination.  Basically, it was my network drive that my personal data drive is backed up on regularly, using Acronis 2016.  Since then, there have been additional uploads after an incremental backup is performed.

I have tried real hard to sort this out including posting at Microsoft, but I have run out of gas and ideas.  One I want to stop it, and two I would like to know where it came from.

Glasswire indicates that the App is "System", the Host is my Seagate 41257D network attached drive, and the Traffic Type is Microsoft-DS Active Directory.

Microsoft told me to disable the Microsoft-DS Active Directory service, but I didn't find any such service to disable.  This is Windows 10.

And this is relevant to Hughes because of the frequent complaints about data leaks.


Gabe has already suggested some possible leak to the Cloud.  Certainly fits this IMO, but I have always said NO! to Cloud services and have not been able to find any signs of this on my computer.  I haven't found any services that would fit, and also have looked at the Scheduler and haven't found anything.  So far, it hasn't run often, but when it does it is fast and furious.  The uploads seem to be tracking the backups to the Seagate drive in both size and frequency.

38 REPLIES 38
williamtobler
New Member

On a sort of related story, I noted recently that the WiFi light on my DSL router was always flashing, except when I turned off my only known WiFi device which is a DirecTV Genie.  Then the WiFi light was dark.  I was worried that this was another data leak, and connected that WiFi through my Linksys WRT1900AC router which tracks bandwidth to each client.  Despite its WiFi light also flashing like crazy, it showed zero bandwidth.  Based on this, I let it connect via the Hughesnet modem overnight and that also showed zero utilization.
GabeU
Distinguished Professor IV

It's possible that the Genie was just "talking" at that point, sending out heartbeat messages to stay connected, but not utilizing any noticeable amounts of data.  

If possible, though, I would keep that Genie connected to your DSL as it can use data when you are aren't looking, and a lot of it.  There's really no telling what it will do.  When someone only has Hughes, they recommend that one doesn't connect a DirecTV receiver at all.  
williamtobler
New Member

The Genie is unfriendly in its menu.  I have found no option to disconnect the WiFi.  To disconnect it, I had to change the WiFi password on the router for around 24 hours before the Genie would give up trying.
GabeU
Distinguished Professor IV

If you go into advanced setup and hit Reset Network I believe that it resets everything back to factory specs, with regard to the network connection, and it will not longer be connected.  Go to Settings and Help, choose Setting, Internet Setup, then Advanced Setup.  Then choose Reset Network.  
williamtobler
New Member

The Genie is only allowed to connect to the DSL router via WiFi.  It is not physically located near an RJ45 port.  I Googled and found others had received $1300 bills from Verizon.
I have a second older receiver connected via RJ45 to Hughesnet and not have had any observable utilization except when I did something deliberate like a "program on demand".


williamtobler
New Member

The Genie is my wife's, and she is almost always recording something.  I went as far as you suggested, and then got a warning that it would take some time and would disrupt any recording while it was doing it.  A happy wife is a happy life.


GabeU
Distinguished Professor IV

A happy wife is a happy life.
ABSOLUTELY!!!  LOL.  

Well, give it a try when nothing's going to be recorded for a while.  
 
williamtobler
New Member

For the period that the Genie was connected to the Linksys to Hughes, the Genie discovered and mated with my HR22 receiver which was also connected by RJ45.  Suddenly all of the recordings on my machine appeared on her machine.  This was around 11:30pm and life was approaching its endpoint.
GabeU
Distinguished Professor IV

It sounds like they have some type of syncing like Windows.  
Gwalk900
Honorary Alumnus

I'm late to the party and am on an old WinXP drive so I can't run or post screenshots of Glasswire but you do wish to exclude "local" traffic. That is LAN side activity and that does not cross over to the modem so does not get deducted from our allowance.

Think having a local storage drive filled with GB's of stored movies. You start up a media center computer to feed a movie from that drive to a TV. That is LAN side local traffic.
One does have to be careful of the settings of any "control software" installed on that drive to insure it doesn't "sync" to some external database such as IMDB to provide "poster graphics and other movie trivia material.

EDIT: Home network are getting so complex these days it has gotten to the point that having a router with traffic data is almost essential.

I still am amazed at the amount of connection "time" the wife's iPad spends connected to various services while in a hibernation state. The Asus 3100 shows every connection.... even to time,com to sync its clock.
GabeU
Distinguished Professor IV

He was able to exclude the local traffic in Glasswire using the options.  All of the excess activity was from his external drive used for automatic backups.  There was 1.4TB of data just from that. 
williamtobler
New Member

Thanks.  I think we agree.  I don't have any of that fancy stuff yet like a "smart tv".  The bulk of the storage are "movies" of our Township Board screaming at each other every two weeks.
We have a new Board now that I sponsored and they are behaving much better.


williamtobler
New Member

I have two router/modems each with 4 ports, and two 8 port switches.  One older HP printer doesn't like to be switched between the two local networks and I often have to manually reinstall it.


williamtobler
New Member

Once the current 6 backup cycle is complete, I will revisit which directories are backed up.  No need to make copy after copy of these videos which are typically 6GB each.
I don't even remember setting up the backup schedule.  I think Acronis snuck that in on me behind my back.  Sneaky software.


Amanda
Moderator

Hey William

I'm there with Gabe - I think your glasswire is tracking local traffic to your external HDD. I see on your Glasswire screenshot the usage is from August to January. In the future I'd recommend looking at a smaller cycle to get a better idea of what's going on. Keep us in the know! 🙂

Amanda
williamtobler
New Member

Yeah.   Thx Amanda.   Previously I had been able to zoom in on the first single 750GB event which was in December.  Last night when Gabe asked for the screenshot, I wasn't able to find it quickly (or at all, in the graph at the bottom), and also was not able to quickly figure out narrowing that range (August to January).  I'll have to play more with Glasswire to become more skilled at using it.  Nevertheless, a bit disappointed in the reporting of the "upload" event which was:

App: System   Host:  Seagate-41257D   Traffic Type:  Microsoft-DS Active Directory

If it had been a real leak, this information isn't terribly helpful.  As it is, we deduced that it must be the backup process by looking at the surrounding evidence instead of the direct evidence.

GabeU
Distinguished Professor IV

Actually, it's more helpful than you think.  By it telling you the host, you're able to see where it's going (in this case the Seagate Drive).  If it was an external leak, as in using the internet, the host information would again tell you where it was going.  Very often a Google search can tell you just what and where that host is, and what it is used for. 

You'll get the hang of Glasswire over time.  It's a lot of info to sort through but very helpful once you get used to its ins and outs, no pun intended.  LOL. 

williamtobler
New Member

I would have preferred that the App be Acronis instead of System, and that the Seagate be referred to as the Destination instead of the Host, and the traffic type be something meaningful, instead of Microsoft-DS Active Directory.   I wasted an hour Googling to find out what that was and obtained nothing useful.

With those 2 simple changes it would have been immediately obvious what it was.

As it was, I interpreted "system" as something unknown in the operating system, the Seagate to be the "source" of the data traffic, and Microsoft-DS Active Directory as the unknown destination (like OneDrive).