Connection issues - Avast! related? + Netstat

[Ashkael]

Hey,

So I'm having some issues with my internet connection that my ISP claims and swears are on my side. I live in a 3rd world country, and therefore my internet service is not that great. I currently have a 4MB DSL connection, and it works fine for the most part. Some times, maybe once a month, my ISP will present problems but they are usually corrected within hours.

However, 3 days ago my connection started acting up. Everything is working fine and all of a sudden, my download speed drops from ~4MB to about 0.2 or 0.3. This persists for about 3 to 10 minutes, then goes away and my connection is back to its regular speed. It happens about 3 times during the course of the night. Now, I've had other issues in the past, but every time my ISP has problems themselves the results on my connection are usually reflected in the form of severe packet loss. This time, my connection is behaving more as if someone was downloading a huge file or as if something was just taking a lot of my bandwidth away.

I phoned my ISP several times and asked them what's going on; one of the times I did this right as the issue was happening. They swear it's entirely on my side, and told me to run some netstats so I could figure out if I have some malware clogging my pipes. Full scans with Avast! free, Malwarebytes and Hitman Pro are revealing nothing. Furthermore, I have 3 PCs at home and when the issue kicks in, it doesn't matter which one of the 3 machines is connected to the network, my bandwidth just disappears, so I'm *pretty* sure it's not related to my machine, but playing a bit with netstat is making me have doubts about this.

I've ran a few netstat tests after and during some activities with firefox, and I've noticed that sometimes there seem to be ridiculous amounts of entries for say firefox or avast, and I was wondering if any of this could have anything to do with the connection issues I'm having.

Netstat taken a few seconds after finishing a speedtest.net test:

Netstat taken just with the Google homepage open and this post in a separate tab:

Netstat taken after clicking on "Images" in the Google homepage:

Netstat taken after travelling to the Anandtech website from the Google Image Search above:

I could be completely wrong here, but it seems to me that's waaay too many ESTABLISHED connections for even some simple things.

I'm 99% convinced the issue is my ISP, and they just don't want to admit it. However, after doing those netstats, and me not having a clue how to read them and not knowing what is considered acceptable, I think it's better to just seek the opinion of someone with far more knowledge than me.

So guys, help me set my mind at ease cause I'm getting paranoid about something being wrong with my main machine right now: are those netstat results acceptable/normal?

 

[RebateMonger]

I'd temporarily uninstall Avast and see if the problem goes away.

And, yeah, those are a HUGE number of connections. I have connections to an Exchange Server, a Windows Home Server, Steam, and a couple of Internet Explorer windows and have less than ten Established TCP connections.

 

[Ashkael]

I'd temporarily uninstall Avast and see if the problem goes away.

And, yeah, those are a HUGE number of connections. I have connections to an Exchange Server, a Windows Home Server, Steam, and a couple of Internet Explorer windows and have less than ten Established TCP connections.

Well, I went ahead and uninstalled Avast!. After restarting, did a netstat and there wasn't a single connection. Then I launched Firefox and pointed my browser to this post, which I got bookmarked. Here's the resulting netstat seconds after fully loading the post:

This doesn't look very normal. Any ideas?

EDIT: I dunno if it's normal, but I noticed the netstat sometimes hangs on the lines labeled with a "TIME_WAIT" at the end. I'm not an expert when it comes to networking, but I'm used to having the netstat command run pretty much instantly. I don't think I've ever seen a full netstat take 1+ minutes as it hangs on multiple TIME_WAIT lines. Then again, I haven't run many netstats in my life either. Heh.

 

[RebateMonger]

It looks like your PC is tryig to grab a Google Page Rank for a web site in Russia . Is that something you are trying to do?

I see IP addresses in Guatemala. Is that where you are from?

 

[Ashkael]

It looks like your PC is tryig to grab a Google Page Rank for a web site in Russia . Is that something you are trying to do?

I see IP addresses in Guatemala. Is that where you are from?

No, I'm from Panama. Guatemala is a couple countries up North. :\

I'm definitely not trying to grab a Google Page Rank from a web site in Russia. Basically, my browser's homepage is set up to www.google.com, so I opened my browser after uninstalling Avast!, and it loaded Google instantly. From there, I went straight to this post from my Bookmarks. That netstat was done after this post was fully loaded.

I've been playing around with netstat on my other 2 machines. Basically I unplug the other two from the network and just go around launching webpages and doing netstats, and I'm seeing very similar results on all 3 machines. Like I said above, I'm not an expert in networking and I rarely ever use the netstat command, so I'm not sure of this is supposed to be normal, but maybe it is considering where I live?