Windows Forum

Ask something
Discussion Locked

Network Traffic

0 helpful
14 replies

by milesrrs

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi
im running w2k server on a small home network, and using a dial up connection for the net....recently, i have noticed that everytime i dial up to the net there seems to be constantly data being sent out on the modem. I have currently been connected to the net for 10 minuts and have sent nearly 5Mb out, even though i havent sent virtually anything. i have run Norton Anti virus and it has not picked anything up, but there is something sending data....any ideas on how to track it down

thanks

Adrian

14 replies

by raffi_

It could be a lot of things. :-|

I suggest that you install a firewall and port monitor suh as this one:

http://www.sygate.com/products/shield_ov.htm

Please do make sure that your server has ALL of the latest seurity patches from MS. Havingthe Code Red worm for instance would cause your network to exhibit this behaviour.

Regards
Raffi_

by gmscne

ZoneAlarm will tell you what programs are attempting to communicate with the Internet. You can let a program have this access or you can say no access for the program. It will prompt you for permission on each program trying to communicate. You needto find out what is sending out all this data. It could be spyware. Windows media player 8 and realplayer 8 are such programs.

by Former member

You might want to go to symantec.com and get the most current upgrade or run some of their worm detection programs. Denial of Service viruses work by running a program on your machine that will send out data to a target computer, when you have a fewthousand machines sending data to the same PC the bandwidth goes away fast.

Hope this helps

by Former member

By the way, I agree with Raffi, since you are running the server version you should check your system for Code Red and symentec's site has a program that will check for Code Red. Also, unless you have a brand new update (within the last couple of weeks) for your virus checker it probably will not detect Code Red.

by agustin.rodriguez

Adrian: since you are running win2k server you should probably make sure that you file and print services anre not utilized trought the modem by disabling the on the bindings also In addition to that I would go to grc.com to do a scan of open portsand see what services you are running that are exposed to the internet. Using the software firewall is also a great idea but it is more likely the Active direcotory bradcasts that are been send out to the internet if you do not check the binding forthe modem. If you really want to make sure no bradcasts go out I would only bind the TCP protocol to the internet connection and nothing more.

Agustin M. Rodriguez, MCSE

by mcmunt

If all the above don't find much, then you might want to install a traffic analyser like Network Monitor. At least then you'll be able to see where all that data is going to in the form of an IP address. 5MB does seem a lot though and is reason for concern

by it tech

As mentioned in other posts you more that likely have a worm or trojan on your system. Instll zonealarm or another firewall product. Zonealarm will ask you if you will allow an application to access the internet. Even Internet Explorer the first time you use it. So when either the worm or trojan goes to access the internet you will get a popup asking if you want to allow. At least this way you will know what apps are accessing the I-net. I was hit with sub7 at one time a easy to use hack program that will install a trojan on target machine allowing the hacker access to the machine. Hope this helps ya some. Have a good day.

This discussion is closed to new replies.