Gizmos Freeware Reviews  

Go Back   Gizmo's Freeware Forum > Debating Chamber > Security

Reply
 
Thread Tools Display Modes
Old 14. Dec 2015, 08:15 PM   #1 (permalink)
Senior Member
 
sicknero's Avatar
 
Join Date: Mar 2012
Location: England
Posts: 657
Default Glasswire notifications

I'm trying out a different security set-up this week, namely 360TS and Glasswire.

The thing is that I'm getting quite regular notifications from Glasswire that my DNS server settings have been changed. For e.g. -



My question is, is this something I should be worried about and find out more, or is it "normal"? The notifications generally seem to appear immediately after boot-up.
sicknero is offline   Reply With Quote
Old 14. Dec 2015, 08:41 PM   #2 (permalink)
Senior Member
 
Join Date: Jul 2010
Location: New Zealand
Posts: 1,741
Default

Normally you will get that message if you have a laptop and you have moved it to another network, i.e. to use another router or wifi spot. It shouldn't change if you are permanently connected to one network.
__________________
Better to light a candle ... than to curse the darkness.
Remah is offline   Reply With Quote
Old 14. Dec 2015, 09:04 PM   #3 (permalink)
Senior Member
 
sicknero's Avatar
 
Join Date: Mar 2012
Location: England
Posts: 657
Default

It's a desktop PC connected via a USB wi-fi receiver. I have the NVidia Networking Controller (ethernet driver I think) disabled as suggested by the usb wi-fi installer.

Glasswire doesn't give any more info except for "New;" and an alphanumeric string which I presume is the new setting. I don't really know where to start to find out more details.
sicknero is offline   Reply With Quote
Old 15. Dec 2015, 04:37 AM   #4 (permalink)
Senior Member
 
Join Date: Jul 2010
Location: New Zealand
Posts: 1,741
Default

Quote:
Originally Posted by sicknero View Post
Glasswire doesn't give any more info except for "New;" and an alphanumeric string which I presume is the new setting. I don't really know where to start to find out more details.
So what is the alphanumeric string which indicates the DNS server address being use because that is probably the key to understanding what is happening?

Is it fec0:0:0:ffff::1 or similar? e.g.:
fec0:0:0:ffff::2
fec0:0:0:ffff::3

These are old IPv6 configuration items - that article is from 2005. They are the default DNS server IPv6 addresses for IPv6 clients. They are now obsolete because IPv6 DNS standards no longer use that anycast method.

You are almost certainly using IPv6. Apparently those addresses can appear even if you are not however I am not certain about that. It usually just means that your computer doesn't have an IPv6 address configured which occurs because you are not connected to your wi fi router.

At least one Glasswire user has this issue:
https://forum.glasswire.com/t/questions-about-two-alerts-im-getting/1423

That user found that it was Windows Defender updates causing the Glasswire alert.
__________________
Better to light a candle ... than to curse the darkness.

Last edited by Remah; 15. Dec 2015 at 04:38 AM. Reason: Fix hyperlink
Remah is offline   Reply With Quote
Old 15. Dec 2015, 07:01 PM   #5 (permalink)
Senior Member
 
sicknero's Avatar
 
Join Date: Mar 2012
Location: England
Posts: 657
Default

Thanks for your input, and the forum link. I think the Defender issue is a separate one relating to svchost.

I didn't know if it was wise to post the full string here. Mine is similar to the one mentioned in the Glasswire thread and your article, but not the same... fdd5:etc.

I had 6 such notifications when I booted up this evening, and it is always the same string.

It does seem as if Glasswire is notifying me about Windows acquiring a server address at boot up.
sicknero is offline   Reply With Quote
Old 15. Dec 2015, 10:03 PM   #6 (permalink)
Senior Member
 
Join Date: Jul 2010
Location: New Zealand
Posts: 1,741
Default

Quote:
Originally Posted by sicknero View Post
I didn't know if it was wise to post the full string here. Mine is similar to the one mentioned in the Glasswire thread and your article, but not the same... fdd5:etc.
If they're local addresses then it is OK to post. In IPv6 they start with FD as yours does:
IPv4 private addresses
IPv6 unique local addresses
__________________
Better to light a candle ... than to curse the darkness.
Remah is offline   Reply With Quote
Old 22. Dec 2015, 08:23 PM   #7 (permalink)
Senior Member
 
sicknero's Avatar
 
Join Date: Mar 2012
Location: England
Posts: 657
Default

Many thanks for your help Remah, the Wiki links seem to explain the basics very well. Amazingly it never clicked with me before that IPv6 actually meant IP v6

Anyway I disabled another driver and the notifications have stopped now ... I had two drivers for wifi, the 802.11n which I guess must be a generic Windows driver, and one for my TP-Link USB wifi receiver.

On first reboot I got the notifications again, but since then Glasswire has been silent on the subject. I'm guessing that maybe the notifications were triggered by the TP-Link driver taking over from the 802.11n one at boot up, or something like that. I will follow up your articles though, I was a relatively late-comer to the internet and still have a lot to learn.

Thanks again.
sicknero is offline   Reply With Quote
Old 23. Dec 2015, 06:01 AM   #8 (permalink)
Senior Member
 
Join Date: Jul 2010
Location: New Zealand
Posts: 1,741
Default

Quote:
Originally Posted by sicknero View Post
On first reboot I got the notifications again, but since then Glasswire has been silent on the subject. I'm guessing that maybe the notifications were triggered by the TP-Link driver taking over from the 802.11n one at boot up, or something like that.
Yes, it notices the change and notifies you.

I'm finding Glasswire to be a useful product. I might even buy it to register my support for their good work and to see whether I find the additional features useful.
__________________
Better to light a candle ... than to curse the darkness.
Remah is offline   Reply With Quote
Old 23. Dec 2015, 08:45 PM   #9 (permalink)
Senior Member
 
sicknero's Avatar
 
Join Date: Mar 2012
Location: England
Posts: 657
Default

I'm liking it too, I was thinking of getting a license just for the Ask To Connect option.
sicknero is offline   Reply With Quote
Old 24. Dec 2015, 01:51 AM   #10 (permalink)
Senior Member
 
Join Date: Jul 2010
Location: New Zealand
Posts: 1,741
Default

FYI, they are considering developing a lot of new features for version 2.0. If you want any implemented then it is worth adding your support in their forum forum.glasswire.com. Many suggestions should bring small improvements to the free version but the biggest benefit will be new features for paid users.

Free
  • Ability to change font sizes for clarity
  • Clearing bubble alerts on the graph once viewed so we can get to the alerts behind it
  • Autodetect regions, date format and language
  • Improving connection to remote servers
  • Mac version. NB This version of Glasswire will be different than the product, L????? S?????, it is often compared to. That well-known mac network monitoring product can be downloaded for free but is really just trialware. It allows you to download for free to trial it but you can only run network monitoring for free for a month before removing and reinstalling, but you also have to stop and restart every three hours.

Possibly free
  • Metered connection stats by network
  • IP lookup

Probably just paid
  • More info on network display
  • More info on network gateways (routers and the like)
__________________
Better to light a candle ... than to curse the darkness.
Remah is offline   Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT +1. The time now is 03:46 AM.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2020, vBulletin Solutions, Inc.