Unexplained traffic - please help

[willirob]

Hi, got netmeter up and running and its pretty cool - noticed some unexplained traffic though this morning - heavy downstream traffic when I was not doing anything.

Can anyone point me to some sofware that tells you whats doing what on the TCP/IP port or similar

thanks

 

[Bjorn]

in the command prompt in XP type netstat -a it will give you alist of all open tcp connections. Sygate Firewall also has a monitor for things like this

 

[willirob]

cool - am a UNIX guy so familiar with netstat.

Didn't think of trying it on XP.

Thanks

 

[Peter_J]

I have used Active Ports from

http://www.protect-me.com/freeware.html

If you are on XP it could be automatic updates running, causing the traffic.

 

[Fyre]

Just remember that Netmeter counts all traffic by default. This means LAN traffic aswell. You can set the interface to report in the options.

I'm using a router so I haven't a clue how to set it just to measure my ADSL traffic.

 

[SecretCode]

I don't think netmeter is capable of distinguishing different kinds of traffic on one interface.

As well as the tools mentioned, http://www.sysinternals.com/ has some goodies including TCPView and TDIMon. May help.

 

[Valerion]

You can also look at http://users.pandora.be/ahmadi/ for Net Tools. This looks like a good set of net monitoring tools, most complete I've seen for Windows so far. And it's freeware.

Also contains a LOT of tools with ... few legitimate uses. Of course, I regularly use nmap and friends against my work and home LAN's to check security, so I suppose I am not in a position to comment

 

[Carlhead]

Have you checked to see if your Windows Update running at 3:00AM or something?

 

[Mean_Monster]

Just an question. You are running some sort of firewall and Anti Virus?

We have many mass mailer hits on our SMTP gateway at the office with Telkom ADSL user IP's. PC's on the ADSL network acting as SMTP Servers and propogating Mass Mail virusses.

I did however notice that you said incoming traffic....

Just a question.