I Finally Tried Simulation Lab 9.1: Module 09 Install And Run GlassWire – Here's What Happened

Ever tried to watch every packet that flits through your home network and felt like you were staring at a wall of gibberish?
That’s the exact moment most people realize they need a tool that actually shows what’s happening, not just a list of numbers. In the world of network troubleshooting, GlassWire has become the go‑to visual firewall for anyone from IT pros to hobbyists. If you’re stuck on Simulation Lab 9.1, Module 09, and the assignment is “install and run GlassWire,” you’re not alone—most of us have wrestled with the same steps, the same doubts, and the same “does this even work?” moment.

Below is everything you need to get GlassWire up and humming in your simulated environment, plus the quirks most guides gloss over. Grab a coffee, fire up your VM, and let’s walk through it together That's the whole idea..

What Is GlassWire in a Simulation Lab?

In plain English, GlassWire is a network‑monitoring and security‑visualization app that sits on top of your Windows (or Android) machine and draws a real‑time map of inbound and outbound traffic. Think of it as a traffic camera for your PC, except it also warns you when an unknown app tries to sneak data out.

In Simulation Lab 9.1 the goal isn’t just to install the software; it’s to prove that you can capture, display, and analyze traffic inside a controlled network scenario. The lab’s “module 09” part usually means you’ve already built a simple LAN with a couple of client VMs, a server, and a router. GlassWire becomes your eyes on that LAN.

The Core Features You’ll Actually Use

• Live Graphs – Bandwidth usage per app, per protocol.
• Alerts – When a new process contacts the internet.
• Network Map – Visual connections between devices (useful for lab reports).
• History – A log you can export for the final write‑up.

You don’t need every premium feature to pass the lab; the free version does the heavy lifting.

Why It Matters / Why People Care

If you’ve ever tried to debug a slow‑loading web page in a sandbox, you know that guessing which app is hogging bandwidth is a nightmare. GlassWire cuts that guesswork out. In a teaching environment it does three things:

1. Visual Proof – Your instructor can see the same traffic picture you do, making grading transparent.
2. Security Awareness – Spotting a rogue connection in a lab mirrors real‑world threats.
3. Skill Transfer – What you learn here translates to tools like Wireshark, NetFlow, or even enterprise firewalls.

Missing GlassWire’s alerts can mean you spend an entire lab session chasing a phantom process that never existed. The short version? It saves time and makes the lab feel less like a scavenger hunt Turns out it matters..

How It Works (or How to Do It)

Below is the step‑by‑step recipe that works on a fresh Windows 10/11 VM inside the lab’s virtual network. Adjust the OS version if you’re on Windows 7, but the core ideas stay the same.

1. Prepare Your VM

• Snapshot first – Take a restore point before you start messing with network adapters.
• Disable any existing firewall – GlassWire will try to add its own rules; a conflicting Windows Defender rule can cause false alerts.
• Ensure internet connectivity – The installer needs to download the latest version; a simple ping 8.8.8.8 will confirm you’re online.

2. Download GlassWire

1. Open Edge (or any browser) inside the VM.
2. work through to https://www.glasswire.com/download/.
3. Click the Free Download button; the file will be GlassWireSetup.exe.
4. Save it to the desktop for easy access.

Pro tip: If the lab network blocks external sites, use the host machine to download the installer, then copy it over via a shared folder.

3. Install the Application

1. Right‑click the installer → Run as administrator.
2. Accept the license agreement (you can skim the fine print).
3. Choose Custom Install if you want to avoid installing the optional “GlassWire System Tray” (it’s handy, so I usually leave it checked).
4. Click Install and wait a minute.
5. When prompted, allow GlassWire through Windows Defender Firewall – this is crucial for the live monitoring to work.

4. Initial Configuration

• First launch: GlassWire will run a quick network scan (takes 10–15 seconds).
• Set up alerts: Go to Settings → Alerts and enable “Notify when new app accesses the internet.”
• Create a profile: In Settings → General, name the profile “Lab 9.1” – this helps you separate lab data from personal browsing later.

5. Run the Lab Scenario

Now that GlassWire is listening, fire up the other VMs in the lab:

• Start a web server on VM‑Server (e.g., IIS or Apache).
• Open a browser on VM‑Client and deal with to http://192.168.1.10 (or whatever address your lab uses).
• Generate traffic – download a small file, stream a video, or run a ping flood if the lab instructions call for it.

Switch back to GlassWire on the client VM. You should see:

• A spike in the Bandwidth Graph labeled with the browser’s process name (chrome.exe, firefox.exe).
• An entry in the Network Map showing a line from the client to the server’s IP.
• An alert if any background service (like Windows Update) tries to connect simultaneously.

6. Capture the Evidence

1. Click History → Export and save the CSV to your shared lab folder.
2. Take a screenshot of the Network Map (press Win+Shift+S).
3. Attach both files to your lab report as proof of “install and run.”

Common Mistakes / What Most People Get Wrong

• Skipping the admin rights step – Running the installer as a normal user will silently fail to add the network filter driver, leaving you with a blank dashboard.
• Leaving Windows Defender on full blast – The built‑in firewall can block GlassWire’s own traffic‑monitoring service, resulting in “no data” errors.
• Using the wrong network adapter – In a virtual environment you might have multiple adapters (NAT, Host‑Only, Bridged). GlassWire will default to the first one it sees, which may not be the lab’s internal LAN. Switch adapters in Settings → Network if needed.
• Forgetting to disable VPNs – A VPN tunnel masks the traffic, so GlassWire will show everything as encrypted outbound to the VPN server, not the lab server.
• Assuming the free version can’t log – It can; the only limitation is the number of alerts stored. Exporting the CSV works fine for a single lab session.

Practical Tips / What Actually Works

• Create a “Lab” shortcut on the desktop that launches GlassWire with the --profile Lab9.1 argument (right‑click → Properties → Target). Saves a few clicks each time.
• Use “Pause” during heavy traffic – If you need to isolate a single event, click the pause button on the graph, run the test, then resume. The graph will highlight only the period you cared about.
• Filter by process – In the Apps tab, right‑click the browser and choose “Show only this app.” Makes the visual clutter disappear.
• Export to PDF – The built‑in screenshot tool can export the network map directly to PDF; perfect for a lab submission.
• Check the “System” tab – Some background services (like svchost.exe) can generate a lot of noise. Mute them if they’re not relevant to the assignment.

FAQ

Q: Do I need a paid GlassWire license for the lab?
A: No. The free version provides real‑time graphs, alerts, and export options—all that’s required for Module 09.

Q: My GlassWire shows “No network activity” even though I’m browsing. Why?
A: Most likely you installed it without admin rights or the Windows firewall is blocking the driver. Re‑run the installer as admin and allow the firewall exception It's one of those things that adds up..

Q: Can I run GlassWire on a Linux VM?
A: GlassWire is Windows‑only (and Android). For Linux labs you’ll need a different tool, like iftop or nethogs.

Q: How do I capture traffic from another VM on the same network?
A: Install GlassWire on the target VM. If you need a central view, run it on the router VM (if it’s Windows) or use a packet‑capture appliance.

Q: Does GlassWire interfere with other monitoring tools like Wireshark?
A: Not really. GlassWire uses a lightweight filter driver; Wireshark can still capture raw packets. In fact, you can run both side‑by‑side for cross‑verification.

That’s it. You’ve installed GlassWire, got it talking to your simulated network, and harvested the data you need for your lab report. The next time you open the app, you’ll recognize that little green line on the graph and know exactly which process is responsible Most people skip this — try not to. That alone is useful..

Enjoy the visual clarity, and good luck with the rest of Simulation Lab 9.1!

Advanced Troubleshooting

If you encounter persistent issues despite following the setup guide, here are some deeper fixes:

• Driver reinstallation – Open GlassWire, go to Settings → Security → "Reset Firewall Driver." This often resolves cases where traffic appears to stall after a Windows update.
• Windows Defender interference – Occasionally, Windows Security will flag GlassWire's network driver as suspicious. Add GlassWire to the Windows Defender exclusions list to prevent it from throttling monitoring.
• Multiple network adapters – If you're running both Ethernet and Wi-Fi, GlassWire may aggregate them. Use the "Network" dropdown in the top-right corner to isolate the adapter connected to your lab environment.

Beyond the Lab: Real-World Application

The skills you've practiced with GlassWire translate directly to real-world network troubleshooting. Understanding which processes generate outbound connections, identifying unexpected traffic spikes, and correlating network activity with system events are foundational competencies for any IT professional. Whether you move on to packet-level analysis with Wireshark or dive into SIEM platforms, the visual intuition you build here serves as a strong foundation.

Final Checklist Before Submission

Before submitting your lab report, verify the following:

• [ ] At least three distinct processes logged with outbound traffic
• [ ] One graph annotation or screenshot showing a traffic spike
• [ ] Exported CSV file containing timestamps, process names, and destination IPs
• [ ] Written analysis explaining the relationship between observed traffic and lab activities

With your data collected, your screenshots annotated, and your conclusions drawn, you're now equipped to document your findings with confidence. GlassWire has given you a transparent view into your virtual network—use that clarity to tell a compelling story in your report Practical, not theoretical..

Good luck with your grading, and happy monitoring!

Additional Tips for Lab Success

As you finalize your submission, keep these extra pointers in mind:

• Timestamp accuracy – Always synchronize your lab environment's clock with your recording device. Even a few seconds of drift can make correlation with other logs difficult.
• Baseline your idle state – Before launching any lab applications, let GlassWire run for 60 seconds. This establishes a clean baseline and makes anomalous traffic easier to spot.
• Use color coding wisely – GlassWire allows you to tag specific processes with custom colors. Reserve distinct colors for your primary lab tools to quickly locate them in a crowded graph.

Common Pitfalls to Avoid

Many students trip up on these recurring issues:

• Ignoring loopback traffic – If your lab involves local server-client communication on the same machine, remember that GlassWire tracks loopback (127.0.0.1) differently than external traffic. Check the "All" view to ensure you don't miss these connections.
• Overfiltering – Applying too many filters early on can hide legitimate traffic that your analysis requires. Start broad, then narrow down.
• Forgetting to export before closing – GlassWire clears its session buffer when closed. Always export your data before exiting the application.

Expanding Your Skill Set

Once you're comfortable with GlassWire's interface, consider exploring these related tools:

• Microsoft Network Monitor – Offers deeper packet-level details and is free from the vendor.
• Process Monitor – Complements GlassWire by showing file system and registry activity alongside network events.
• SolarWinds NetFlow Traffic Analyzer – A step up in complexity, ideal if you later work with enterprise-grade flow data.

A Final Thought

Network monitoring is as much about curiosity as it is about technique. When a spike appears without obvious cause, dig deeper. Day to day, the best analysts aren't just skilled with tools—they're relentless in asking "why? " When you see an unfamiliar connection, investigate it. This mindset will serve you far beyond this lab.

Most guides skip this. Don't.

Conclusion

Simulation Lab 9.1 has walked you through the fundamentals of visual network monitoring with GlassWire. Because of that, you've installed the software, configured it for your virtual environment, captured meaningful traffic data, and learned how to troubleshoot common obstacles. More importantly, you've developed an intuitive sense for how processes communicate over a network—a skill that underpins nearly every aspect of modern IT operations It's one of those things that adds up..

As you submit your report, remember that this lab is a foundation. The concepts you've practiced here scale to enterprise networks, cloud infrastructures, and security operations centers worldwide. GlassWire may be your starting point, but the analytical mindset you've cultivated is what will drive your long-term success.

Good luck with your grading, and happy monitoring!

Diving Deeper: Correlating Network Events with System Activity

Now that you’ve captured a clean traffic trace, the next logical step is to correlate what you see in GlassWire with what’s happening on the host. This practice reinforces the cause‑and‑effect relationship between a process and its network footprint.

This is where a lot of people lose the thread.

By habitually performing these cross‑checks, you’ll start to build a mental map of how different layers of the OS interact with the network stack—a skill that pays dividends when you later troubleshoot real‑world incidents Which is the point..

Automating Repetitive Capture Tasks

In a classroom setting, you may need to repeat the same capture scenario across multiple VMs. GlassWire’s UI is great for ad‑hoc analysis, but for scripted reproducibility you can combine it with a lightweight command‑line sniffer.

1. Create a PowerShell wrapper that launches GlassWire, waits a configurable warm‑up period, and then triggers an export.

   # Start GlassWire (silent mode)
   Start-Process "C:\Program Files\GlassWire\GlassWire.exe" -ArgumentList "/silent"
   Start-Sleep -Seconds 10   # give GlassWire time to initialize
   
   # Run the lab activity (e.g., start a simple HTTP server)
   Start-Process "python" "-m http.
   
   # Capture for 60 seconds
   Start-Sleep -Seconds 60
   
   # Export the current session to CSV
   $exportPath = "C:\LabExports\session_$(Get-Date -Format 'yyyyMMdd_HHmmss').exe" -csv $exportPath
   

2. csv" & "C:\Program Files\GlassWire\GlassWireExport.Schedule the script via Windows Task Scheduler to run at the start of each lab period, guaranteeing a consistent capture window for every student.

This changes depending on context. Keep that in mind That alone is useful..

While GlassWire itself does not expose a native CLI for data extraction, the community‑built GlassWireExport.exe utility (available on the GlassWire forums) reads the SQLite database directly, allowing you to automate the export step without UI interaction.

Interpreting the Exported CSV

When you open the CSV in Excel or a scripting language like Python, you’ll see columns such as:

A quick Python snippet to summarise the top talkers:

import pandas as pd

df = pd.So agg({'BytesSent':'sum', 'BytesReceived':'sum'})
         . In practice, groupby('ProcessName')
         . csv')
top = (df.read_csv(r'C:\LabExports\session_20260518_101530.sort_values('BytesSent', ascending=False)
         .

The output will instantly tell you which five processes consumed the most outbound bandwidth during the lab—perfect for a concise lab report paragraph.

### Extending the Lab: Introducing a Man‑in‑the‑Middle (MITM) Scenario

If you want to push the envelope, add a lightweight MITM proxy (e.g., **mitmproxy** or **FiddlerCore**) between the client VM and the internet. Configure the client’s proxy settings to point at the proxy VM, then repeat the capture. 

- **Additional local connections** (client → proxy) that were not present in the baseline run.
- **Repeated remote IPs** now appearing under the proxy’s PID instead of the original client process.
- **Potential certificate warnings** if you attempt HTTPS interception without installing the proxy’s root certificate.

Document how the traffic graph changes, and discuss why the proxy’s process now dominates the “Outbound” pane. This exercise reinforces the concept that **network visibility is always relative to the observation point**—what looks like a single flow in one host may be split into multiple hops elsewhere.

### Grading Checklist (For Instructors)

| # | Requirement | Full Credit | Partial Credit |
|---|-------------|-------------|----------------|
| 1 | GlassWire installed and running on the lab VM | Yes | Installed but not started |
| 2 | Capture started **before** any lab traffic | Yes | Started after some traffic |
| 3 | Exported CSV file submitted with the report | Yes | Export missing or corrupted |
| 4 | Graphs annotated with process names and timestamps | Yes | Graph present but missing annotations |
| 5 | Correlation analysis using at least one complementary tool (ProcMon, netstat, etc.) | Yes | Correlation attempted but incomplete |
| 6 | Optional MITM extension documented (if attempted) | Yes | Attempted but no clear findings |

Providing this checklist to students clarifies expectations and makes grading transparent.

---

## Closing Remarks

Simulation Lab 9.1 was designed not merely to teach you how to click a few buttons in GlassWire, but to **instill a disciplined workflow** for network forensics:

1. **Prepare the environment** – isolate, configure, and verify that the monitoring tool sees the traffic you care about.  
2. **Capture deliberately** – start early, capture long enough, and avoid filters that hide the signal.  
3. **Export and preserve** – treat the capture as evidence; back it up before you close the program.  
4. **Cross‑reference** – validate what GlassWire shows with OS‑level utilities and, when possible, packet‑level sniffers.  
5. **Reflect and iterate** – ask why each spike occurred, adjust filters, and repeat until the picture is clear.

By mastering these steps, you’ll transition from a passive observer to an active investigator—capable of turning raw network bytes into actionable intelligence. Whether you later secure a corporate perimeter, debug a cloud‑native microservice, or hunt for malicious C2 traffic, the habits forged in this lab will be your compass.

Good luck on your submission, keep experimenting, and remember: the network never lies; it only waits for a curious mind to ask the right questions.