Windows Forum

Ask something
Discussion Locked

Unknown traffic coming from my server!

0 helpful
9 replies

by admin 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I'm running a mission-critical Windows 2000 Server with SQL and web services. For the last week it's been generating 800K per second traffic in and out. I've replaced the NIC, to insure that it's not a freaked out hardware problem. I've run anti-virus scans on disks, memory and in safe mode, but NO change. I do not see any unusual usage in processes under task manager. PLEASE, can someone help give me a step-by-step method of finding what's generating this! HELP!

9 replies

by curacao_dejavu

open a dos prompt and type in netstat to see what connections are to that server.
(or use active ports which is free)

by razz2

I agree that you should check netstat, and TCPView may help too, but I just had a few questions as well as suggestions.

First of all, are you behind a firewall with good logging capabilities? If so check the log and see what the traffic source/destination is. You might even go so far as using Ethereal ( http://www.ethereal.com/ ) to analyze the traffic.

Second, You mentioned an anti-virus scan in safe mode, but does the traffic disappear in safe-mode? If so then try finding out if a service is doing it. Try scanning with Ad-Aware AND Spybot S&D. I would even in normal mode stop Internet Information Services and see if that causes it to dissappear. If so then check your IIS install as it may have been compromised.

Good Luck,

razz

by admin

Unfortunately, I am NOT behind a firewall yet. I have a PIX, and the move is on my to-do list.

TCPView revealed some suspicious processes, like "slave.exe" and some unwarranted connections. I ended thoses processes and it seemed to kill the traffic. I'm going to keep an eye on traffic til Monday late AM, and see if it re-occurs.

This discussion is closed to new replies.