Incoming Traffic With Neotel

[bawrak]

Hi,

When I'm connected with Neotel (I am one of the lucky ones who actually can connect ) I get a LOT of incoming traffic that my firewall luckily blocks.

I thought this was a virus/trojan/spyware thing on my PC but then I noticed the firewall shows no incoming traffic when I connect through the 3G Modem.

Why is this and does anyone else have this issue? I thought the Neotel ports are closed by default (I did not ask for them to be opened)? And I guess I am going to pay for all this incoming data ?

One minute from my firewall log on Neotel:

FWIN,2009/03/23,10:09:00 +2:00 GMT,24.137.200.27:50528,41.174.11.187:13497,UDP
FWIN,2009/03/23,10:09:18 +2:00 GMT,209.161.234.231:62928,41.174.11.187:13497,TCP (flags:S)
FWIN,2009/03/23,10:09:18 +2:00 GMT,115.132.5.105:4197,41.174.11.187:13497,TCP (flags:S)
FWIN,2009/03/23,10:09:20 +2:00 GMT,85.60.51.227:57981,41.174.11.187:13497,TCP (flags:S)
FWIN,2009/03/23,10:09:20 +2:00 GMT,77.6.105.0:13695,41.174.11.187:13497,UDP
FWIN,2009/03/23,10:09:20 +2:00 GMT,85.60.51.227:57999,41.174.11.187:13497,TCP (flags:S)
FWIN,2009/03/23,10:09:22 +2:00 GMT,80.55.155.42:17687,41.174.11.187:13497,UDP
FWIN,2009/03/23,10:09:22 +2:00 GMT,85.60.51.227:58008,41.174.11.187:13497,TCP (flags:S)
FWIN,2009/03/23,10:09:24 +2:00 GMT,81.102.59.35:58941,41.174.11.187:13497,UDP
FWIN,2009/03/23,10:09:24 +2:00 GMT,85.60.51.227:58026,41.174.11.187:13497,TCP (flags:S)
FWIN,2009/03/23,10:09:34 +2:00 GMT,91.125.131.36:41349,41.174.11.187:13497,UDP
FWIN,2009/03/23,10:09:34 +2:00 GMT,122.3.125.28:10033,41.174.11.187:13497,UDP
FWIN,2009/03/23,10:09:34 +2:00 GMT,90.193.129.100:2651,41.174.11.187:13497,TCP (flags:S)
FWIN,2009/03/23,10:09:36 +2:00 GMT,24.99.37.195:2734,41.174.11.187:13497,TCP (flags:S)
FWIN,2009/03/23,10:09:36 +2:00 GMT,117.20.153.216:2966,41.174.11.187:13497,TCP (flags:S)
FWIN,2009/03/23,10:09:36 +2:00 GMT,85.60.51.227:58128,41.174.11.187:13497,TCP (flags:S)
FWIN,2009/03/23,10:09:42 +2:00 GMT,67.246.100.203:10000,41.174.11.187:13497,UDP
FWIN,2009/03/23,10:09:50 +2:00 GMT,88.5.76.202:4662,41.174.11.187:13497,UDP
FWIN,2009/03/23,10:09:52 +2:00 GMT,209.240.115.39:56165,41.174.11.187:13497,TCP (flags:S)
FWIN,2009/03/23,10:09:56 +2:00 GMT,98.193.60.156:12232,41.174.11.187:13497,UDP

Advice anyone?

TIA

 

[Abmis]

Are you using a peer to peer download application? Those could be other peers trying to connect to you.

 

[bawrak]

Thanks, I thought of that as well...

I checked that uTorrent is not running and it also does not explain why the firewall does not show the incoming traffic when I am on the 3G connection

 

[medicnick83]

Check your other applications, goto the task manager and see what other applications are running, then close those tasks, check the traffic, end a task, check the traffic, once you find the problem, Google the name of the application running to see what it is... maybe it's spyware.

 

[Ice2Cool]

Usually, even after closing a torrent application, peers will still try to connect to you for a while as they are unaware that you are not dloading anymore. You would have to disconenct and reconnect (and be issued with a new IP) for those to stop (if infact they are a result of torrents).

 

[bawrak]

I ran hijackthis and there is nothing unusual... plus I have rather strict firewall rules.

@ushir
I think this makes the most sense. I might still have the same IP I had while I used uTorrent and the firewall just blocks it now because the app is not running. It would also explain why I don't get the same traffic on the 3G connection (not the same ip)