Paranoia Bandwidth Monitoring? :)

Hi! I downloaded DU Meter as recommended by Virgin Media to monitor my bandwidth usage during peak times.

I don't know if this is right or not but DU meter shows that my connection is constantly uploading and downloading but only at very low speeds. I've been monitoring it since 4pm and the network traffic is reported as between 1 - 5 Kilobytes a sec upload + Download.

In the space of about 5 hours there's been a total of 100mb in traffic tracked by DU Meter.

I have checked my firwall and it appears to be working correctly. I've also done a scan for trojans, spyware and viruses. Nothing has been found.

My question is, is it normal for there to be traffic like this?

Is what DU meter picks up just background stuff?

If you're using a bittorrent client or something, its likely that its still uploading as a background service.

As far as I know, this is what Limewire does - you're still sharing files even if Limewire itself isn't actually running.

Nothing like that is running. I don't have limewire but do use utorrent. As far as I know that isn't running at all atm.

Not hooked up to a LAN or anything I take it?

Anyhow, as Gfk suggested, not much we can suggest aside from the fact there's the very likely occurance is due to something currently running under yer processes that's talking to the network.

Could always do the 'process of elimination' route and kill non-essential tasks from it one by one and see if anything happens...

Try this:

http://www.microsoft.com/technet/sysinternals/Utilities/TcpView.mspx

Maybe it's something your ISP is doing? I don't get any traffic at all when not using my browser, or other net app.

What I would recomend you do is this.

Drop to dos.
Useing Netstat -ano
look for anything with an open connection or open port possibly connected port.

The last set of numbers are that ports process id.

Then use Tasklist and find the PID, to find out whats got that port open.

From here you can then do a taskkill /pid #### and shut the process down. see taskkill help for more details.

Do this until you have shut down all open connections and are happy that your computer is no longer sending anything over the net.

They check your monitor, if your still shwoing a little traffic, and your not on some network or using some proxy for net access, then download WireShark and run that.

WireShark will let you examine each packet being sent or received. its good for things like this.

You will probably find its keep alive signales being sent and received from your router. or your isp, or something else thats not harmfull..


If you are UBER Paranoid tho, you might want to look into rootkits, A rootkit is different from a common trojan, its purpose is to plant itself on a system giving its user a backdoor in and keeping itself hidden from even the system admins. these are more common on linux systems, but can be found for windows. if you have done all of the above and your still worried, then try a fresh install of windows, if you still see the traffic after a fresh install then its probably an OS thing, and nothing to panic about.

I use uTorrent, too.

I get data transfer even when uTorrent isn't open, but only if I have uTorrent's port opened on my router. So I generally don't bother with port forwarding any more. uTorrent still works, and its no slower for it.

I notice frequently flickering of my upload/download lights on my modem when I am not using the computer to do anything. I sometimes suspect hacking or foul play but then turn off the modem :-D

Thanks for the suggestions. It's definately got to be something caused by my network card. I'm not connected to a router, my connection is direct to the net via the Cable modem and network card.

I noticed that when I Blocked all traffic with AVG Firewall it didn't make a difference to what DU Meter was displaying. It was still showing that I was uploading and downloading very small amounts.

I'm gonna try and unplugg the Cable Modem and see what happens. If it still reports network traffic then I know it's something going on behind the scenes with Windows Vista.

Thanks Again :)

Windows is forever phoning home, checking this and that. I'd suspect Vista especially will be constently contacting home. And if you've got those widget things switched on they constantly update too.

Using something like NetLimiter you can know each programs traffic, with a firewall to ban unwanted connections.

If you're using IM softwares or eMail checker, or software with online update, it's pretty possible.

What packet size are being sent ?

Its possibly like I said just keep alive signals being send from the OS to the modem to see if your still online. Its not something I would worry about if the packet size is so small.

the best thing to do is have a complete system scan done, full virus scan with your ac of choice, then do a full malware or spyware scan with your spyware scanner of choice, and finally run a registery scan with again your registry scanner of choice. if all come back clean your fine.

Note that if you have been part of a file sharing network recently, there will still be aa bunch of computers trying to connect to your PC requesting the file(s) you were sharing. sounds like that's the case here, where you have a long trickle effect of PC's asking for the file. You don't have the torrent app open so there is no actual upload happening, but the *requests* will continue to come in for a long time. so... Most likely it's fairly harmless.

Thanks for all the replies. I have it sorted now.

DU Meter, although good, does not accurately detect bandwidth usage.

It's all sorted now so thanks for all the help guys. :)