Windows Forum

Ask something
Discussion Locked

Mysterious Incoming Packets

0 helpful
6 replies

by webguybob

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Fellow techies,

I have just installed XP Home, at home. One of the first things I noticed is that when I now dial up to ISP, there is a constant stream of incoming packets over my connection. And, this is to the tune of ~20% of my bandwidth...let's say about 7 MB worth in one hour's time.

I've tried sorting all of my files by latest time stamp and size and it appears that my XP firewall log is just about the only thing that's being constantly updated...other than the typical log files. How can I find out where this data is being written...or if it is being written at this pace?

Here are some facts:
- I have disabled Auto-update service
- I have disabled McAfee and it's update service
- I have disabled MSN/IM's Auto-update
- There are no other Winsock-capable programs installed

TIA,

Bob

6 replies

by curlergirl

Does this stream start as soon as you connect? Do you have any other web-enabled stuff open at the time - such as chat programs (AOL is a famous one for eating up bandwidth), any web-based pages that constantly update info like news, weather, etc.? Just because there's traffic doesn't mean that any data is being written anywhere, at least not permanently. You can try some packet monitoring software if you think it's important enough - I've used Ethereal (www.ethereal.com). This will show you exactly what packets and where they're coming from. Hope this helps!

by webguybob

Synergy...because this started as soon as I installed XP, I figured it would be something related to the OS that I could disable and that somebody would have already experienced who had a direct solution. I will check out Ethereal, but meanwhile I'll leave this open for other explanations. Thanks...Bob

by greybeard770

You could load (free) Zone Alarm and it would tell you the source and type of the packets. The results may terrify you. You may be the victim of a port scan or worse.

by webguybob

Greybeard...because this started as soon as I installed XP, I figured it would be something related to the OS that I could disable and that somebody would have already experienced who had a direct solution. I installed Zone Alarm, but oddly after Iapproved/disapproved appropriate programs...and disabled all microsoft net-related programs (I think), this stream is still coming in at the same rate. I'll leave this open for other explanations. Thanks...Bob

by techyeric

Interesting. I have nearly the opposite problem. When I connect my laptop over a LAN, I am getting something in the neighborhood of 5 million plus packets SENT and only a couple dozen recieved. All in less than 3 minutes. It continues for as long as I am connected. I don't know what is sending these packets. I have a firewall installed and only a few programs are allowed unrestricted access. This does NOT happen when connected to my ISP via my 56k dialup, but only over the 10/100 ethernet connection from work. Go figure.

by webguybob

Scott...That is pretty bizarre! The only thing that I can think of there is that when you log on at work, your user/system profile is trying to sync with a PDC or BDC based on the changes from your home session. As the suggestions shown above, youmay want to install some diagnostic software (other than your firewall) to see what port and protocol are active for that stream.

On a more paranoid note, your IS department may discreetly have installed keystroke and/or file monitoring software which runs in the background and that recorded data is sent to the sysadmin when you login at work. :-O

Regardless, good luck with it all. I think I'm going to scrap XP Home edition, purchase the upgrade to Pro and do fresh install. Wish me luck too. LOL

Thanks,

Bob

This discussion is closed to new replies.