Unknown network activity

[Artician]

Hi all,

I have a good amount of technical knowledge, so hopefully this isn't your usual case of someones un-tech-savvy grandmother being unkowingly infected with 500 types of spy/adware, but my PC has acquired an interesting characteristic over the last few months that I can't solve alone. Here's the problem:
My PC always seems to have some network activity, even when no network enabled applications are open. The stranger part is that it's oddly behaving network activity. If I view my Local Area Connection Status window from Network Neighborhood, my PC will send and receive anywhere between 10 - 20 packets of data every second, on the second. Like clockwork, with no idea why. I will shut down every piece of networking software on my machine, and disable net access to any processes that don't otherwise require it, but it still continues. This is not happening consistently all of the time, but I usually spot it during 90% of my PC's uptime. I am running WinXP SP1. I have used all available applications for finding spyware and adware. I keep my PC clean as a whistle, never had a virus, and never come within contact of any other harmful data of that sort.

So this has me a bit worried, and that's my primary issue. I've never seen this happen before, but despite every search I do coming up clean I can't shake this freaky feeling. Thanks in advance for any advice you can give me!

 

[skyking]

Not to worry, too much. There are a ton of protocols that "phone home", or have some other heartbeat traffic.
From your post, it sounds like you care, and want to know about all that. The easiest way is to install a software firewall, such as:

Free version of zonealarm.
Free version of kerio.
30 day tial of Tiny firewall.

Install one of those, and set it up to notify you of all outgoing traffic. You will need a couple of hours to do this, but in the end, you will know a great deal more about what you have installed on your computer, what it does, and IF you want to keep it that way.

 

[Artician]

Hi SkyKing,

Thanks for replying. Yeah I do care somewhat, primarily because I'm already running ZoneAlarm already, which is what started my concern. I monitor what apps get network permissions pretty closely and this is new, unknown activity to me. If I shut down all apps that have permissions, but leave my network connection enabled, the only thing I can think of that would be utilizing it anyways is WinXP itself (likely, right?) or some form of malware. If it's the OS or some other app I wanted to know what and why too, so I thought a post here might help.
Thanks again!

 

[skyking]

Even if it is xp, zonealarm would detect it. It sounds like these are applications you have previously granted permission to.

 

[statik213]

Also, one thing to check if you have an FTP server running is if there is a '/pub' folder with anonymous write permissions.

Warez groups use unprotected public ftp servers to store warez for download by their users. Happened to me once... i saw that my machine was downloading alot fo stuff and I used netstat (winxp tool) saw that ftp port was active, looked at my ftp log and there was a whole bunch of stuff being put onto my /pub folder. The folders they had created had illegal characters in them to prevent you from deleting them via explorer or the regular del/rd command through the comamnd line. Turns out there is an extended way of specfying paths that lets you delete folders with illegal names.. don't remember the format but if you need to search @ microsoft.

 

[spidey07]

download ethereal and see what it is.

10-20 packets a second is very excessive for what I call "background noise". That stuff is always present with MS operating systems but nothing more than a few packets every 10 seconds.

 

[Artician]

Thank you for the help. I checked out ethereal and it seems to display CRC errors (???) between windows and the Router? This makes little sense to me. I switched to Win2k for a while and the problem did not crop up, but because my work demands XP I reinstalled several weeks later and it's still occuring. This is on a fresh install of XP SP1 at the moment.
Thanks again for the tips. Just a very strange and bothersome issue.

 

[Garion]

CRC errrors usually indicate a cabling problem between your PC and the router or something wrong with the link.

Things to try:

A new cable
Try to make sure your NIC settings are at auto speed, auto duplex. If it persists, change them to 100 Mb/s speed, full duplex. If it persists there, go to 100Mb/s half duplex. You won't be able to notice any speed difference between full and half duplex on a home LAN (generally), so no biggie.

If that doesn't work, post again and there's a few more things to try.

- G

 

[nbarb99]

It's a long shot, but could it be your computer and the router attempting to run various UPnP discovery services? Lots of consumer routers now have UPnP functionality (usually with upgraded firmware).

I agree with Garion, I'd check the network cable, if possible. :thumbsup: