|
I''m currently using an ISP that has a bandwidth cap of 175 GB / fiscal month.
I have been exceeding the cap and haven't been doing anything that bandwidth intensive so I got suspicious and downloaded a piece of software to assist me in monitoring bandwidth it's called 'Net Meter' (this was just a few minute ago).
I closed all programs in the task manager via the process tab that use bandwidth and Net Meter was still telling me that I was using upto 1 MB down/500KB UP almost every other minute.
Over the course of 3:00 minutes I had used about 5 MB down and 1 MB up with absolutely no programs running that use bandwidth.
Is this normal? Am I overreacting ? Could this be spyware/other malicious software?
I'm looking for isight/suggestions to help figure out what's wrong.
Thank you in advance.
|
spyware could be using your bandwidth however its unlikely because it would probably use a lot more than it currently is. it could also be the programs your running as they will phone home (windows for example) to check updates etc.
|
just to get the obvious out of the way, you are using a firewall with password for your network right?
|
Do you use a wireless router?
If so, is it properly secured?
Do you share it with anybody?
|
I'm not sure if malware would necessarily be transferring that much or little data over the network, but that seems plausible to me.
edit: if your network monitoring is on your own computer, it should be monitoring traffic in and out of the network interface. You wouldn't pick up somebody else using your network.
You should try confirming the traffic with a packet sniffer like Wireshark:
http://www.wireshark.org/download.html
That can also let you investigate where all that traffic is heading towards, and maybe what kind of information is in there.
|
A quick scan with http://www.idealsoftware.nl/MBAM/ can never hurt 
Also people talking about the wireless router. He was monitoring it locally and you shouldn't have any network activity besides communication with the router/other computers in the network.
However, you should check if you have anything shared with other people in your network. They might be streaming something from/to your pc and that might be the activity you see.
|
On July 28 2011 05:13 EZjijy wrote:
Do you use a wireless router?
If so, is it properly secured?
Do you share it with anybody?
I have a wireless router. Wiereless is off. I am sure of this.
On July 28 2011 05:12 striderxxx wrote:
just to get the obvious out of the way, you are using a firewall with password for your network right?
Yes, Username & password have been changed from their default too
.
On July 28 2011 05:16 Myrmidon wrote:I'm not sure if malware would necessarily be transferring that much or little data over the network, but that seems plausible to me. edit: if your network monitoring is on your own computer, it should be monitoring traffic in and out of the network interface. You wouldn't pick up somebody else using your network. You should try confirming the traffic with a packet sniffer like Wireshark: http://www.wireshark.org/download.htmlThat can also let you investigate where all that traffic is heading towards, and maybe what kind of information is in there.
Thanks for the link, I'll look into this.
Additional information: It's a cabel modem. You guys think it's just a safe assumption that it's just checking traffic/doing things to make sure the network's working and in reality I really am using 175 GB/month ?
|
It's probable. Small transfers could very well be various systems phoning home, checking for updates, or whatever.
However, if you want to *know* then sniff the packets as detailed above. Figure out what that traffic is, or at least where it's going.
Personally I use 150-200 GB a month. Steam, youtube and watching streams all eat bandwidth.
|
Ugh I feel sorry for people with bandwidth caps, that is just cheap ass move by the telecom companies seeing as like 60-70% of their customer base will be joe blow and grandma jane who use up like 1% of their cap
|
On July 28 2011 06:37 gosuMalicE wrote:
Ugh I feel sorry for people with bandwidth caps, that is just cheap ass move by the telecom companies seeing as like 60-70% of their customer base will be joe blow and grandma jane who use up like 1% of their cap
Yea, it's a pretty rediculous rip off, however it's difficult to fight it because as you said most average people wouldn't break the cap, hell most average people are too stupid to understand why they're getting charged more than normal and just don't even care.
|
On July 28 2011 06:46 Scrubington wrote:Show nested quote +On July 28 2011 06:37 gosuMalicE wrote:
Ugh I feel sorry for people with bandwidth caps, that is just cheap ass move by the telecom companies seeing as like 60-70% of their customer base will be joe blow and grandma jane who use up like 1% of their cap Yea, it's a pretty rediculous rip off, however it's difficult to fight it because as you said most average people wouldn't break the cap, hell most average people are too stupid to understand why they're getting charged more than normal and just don't even care.
The only way to fight it is to switch the ISP. If you can't, well, blame your government for not protecting customers.
|
I'm assuming you mean Mb in the OP and not MB (8x the amount), because that would be insane, especially for Canadian internet.
There's no way programs checking for updates and all that background jazz would use nearly that amount. If no one else is using your network and you are actually sure that much bandwidth is being used constantly then some malicious is probably going on. Windows has it's own network monitoring graph if you Ctrl + Alt + Del > Task manager > Networking tab. Check there too.
|
On July 28 2011 08:47 Grobyc wrote:
I'm assuming you mean Mb in the OP and not MB (8x the amount), because that would be insane, especially for Canadian internet.
There's no way programs checking for updates and all that background jazz would use nearly that amount. If no one else is using your network and you are actually sure that much bandwidth is being used constantly then some malicious is probably going on. Windows has it's own network monitoring graph if you Ctrl + Alt + Del > Task manager > Networking tab. Check there too.
I did mean Mega Bytes and not bits in the OP. That's why I'm concerned. I ran Ad-Aware and it didn't detect anything except for key generators that I torrented.
|
On July 28 2011 09:00 Scrubington wrote:Show nested quote +On July 28 2011 08:47 Grobyc wrote:
I'm assuming you mean Mb in the OP and not MB (8x the amount), because that would be insane, especially for Canadian internet.
There's no way programs checking for updates and all that background jazz would use nearly that amount. If no one else is using your network and you are actually sure that much bandwidth is being used constantly then some malicious is probably going on. Windows has it's own network monitoring graph if you Ctrl + Alt + Del > Task manager > Networking tab. Check there too. I did mean Mega Bytes and not bits in the OP. That's why I'm concerned. I ran Ad-Aware and it didn't detect anything except for key generators that I torrented.
that's probably the cause, a lot of keygens have nasty stuff in them. Especially if they're for products like Office/Photoshop etc.
Either use a packet sniffer to find the exact cause/where things are going so you can research what is hitting you, or do a clean install of windows. Your choice.
|
Yeah you really need to find out where all that bandwidth is going then. Use wireshark as Myrmidon suggested and see what's up. That's an insane amount of traffic.
|
If you dont run a firewall yet, get comodo free firewall. Comodo firewall can monitor internet traffic and you can cancel specific connections with one click(It allso shows how much is transferred per connection/port/program).
|
On July 28 2011 09:43 Madoga wrote:
If you dont run a firewall yet, get comodo free firewall. Comodo firewall can monitor internet traffic and you can cancel specific connections with one click(It allso shows how much is transferred per connection/port/program).
thanks for the suggestion, I'll be sure to get it.
|
do u have a program called pando media booster installed?
|
On July 28 2011 10:11 facemelterr wrote:
do u have a program called pando media booster installed?
No
|
Just for update purposes, I've installed COMODO Firewall and it looks like there isn't any malware/suspicous process running that takes up bandwidth. Skype apparently uses up a TON of bandwidth, other than that I don't know. I'm still using 5 GB-6GB a day, any suggestions on how to cut down on bandwidth usage?
Programs I NEED to run on a daily basis are; Firefox, Skype, and Starcraft II.
|
On July 28 2011 12:44 Scrubington wrote:
Just for update purposes, I've installed COMODO Firewall and it looks like there isn't any malware/suspicous process running that takes up bandwidth. Skype apparently uses up a TON of bandwidth, other than that I don't know. I'm still using 5 GB-6GB a day, any suggestions on how to cut down on bandwidth usage?
Programs I NEED to run on a daily basis are; Firefox, Skype, and Starcraft II.
Skype is known for being bandwidth heavy, http://www.netlimiter.com/ it costs money but people say it works like a charm. There is also a couple other things mentioned that might be helpful.
link from forums were I found it. Took me 5 seconds to google it.
http://forums.thinkbroadband.com/voip/3662826-skype-hogs-lan-upload-bandwidth.html
|
when you said 1MB down and 500K up do you mean mbytes/s or mbits/s?
And 5mb downloads in a 3min duration from web browsing/background tasks doesn't seem that much of a deal imo.
If you have a router capable of installing tomato firmware, you can do that to check the connection list or the real time bandwidth graph to see how you are doing.
|
On July 28 2011 06:37 gosuMalicE wrote:
Ugh I feel sorry for people with bandwidth caps, that is just cheap ass move by the telecom companies seeing as like 60-70% of their customer base will be joe blow and grandma jane who use up like 1% of their cap
The maximum amount you can have with any ISP for any non business affiliated individuals in my country is 40 GB. I hate this backwater country.
|
On July 28 2011 14:00 HydraLF wrote:
when you said 1MB down and 500K up do you mean mbytes/s or mbits/s?
And 5mb downloads in a 3min duration from web browsing/background tasks doesn't seem that much of a deal imo.
If you have a router capable of installing tomato firmware, you can do that to check the connection list or the real time bandwidth graph to see how you are doing.
Byte. NOT bit. I've clairified this earlier in the thread.
|
I run Skype, Firefox, and Starcraft II daily, hosting 4-5 person calls. Hell, before, I even hosted a Minecraft server 24/7, and still get a little bit under 100GB a regular month. I have a 22Mbps download and a 4Mbps upload.
You should probably double check your wireless settings, torrent settings, and etc.
Maybe you're seeding without realizing it?
I honestly cannot think of a reason besides that which would let you break a high cap.
|
There's something fishy going on or something you're not telling us. 6GB / day is not possible with Skype and browsing unless you are doing video chat or streaming hours of 720p / 1080p content. I have over two thousand torrents seeding and can barely break 10GB / day on a 12/1 connection.
|
On July 28 2011 14:27 skyR wrote:
There's something fishy going on or something you're not telling us. 6GB / day is not possible with Skype and browsing unless you are doing video chat or streaming hours of 720p / 1080p content. I have over two thousand torrents seeding and can barely break 10GB / day on a 12/1 connection.
It's 5-6GB a constantly on Skype in a voice chat, with a 720P stream open OR while playing starcraft for 2-10 hours/day depending on the day.
It just seems odd to me that I'm using so much bandwidth while I'm idle.
EDIT: THESE are the processes that I normally have running MINUS Skype.
Anything look odd?
|
That 1.2 GB total in for firefox plugin looks rather suspicious to me.
Can you explain why it's so high or did you not notice that?
edit
I'm guessing that its from having a stream open for a long time.
|
On July 28 2011 14:56 Equalizer wrote:
That 1.2 GB total in for firefox plugin looks rather suspicious to me.
Can you explain why it's so high or did you not notice that?
edit
I'm guessing that its from having a stream open for a long time.
Yes, it is.
|
You said that you shut down all programs via task manager, but did you shut down other background processes? TaskManager should show you all running processes. You can run the meter, start shutting down processes, then find where it goes down.
Also, other things that phone home often are things like Adobe and Java which run in the background at start up most of the time.
|
On July 28 2011 14:37 Scrubington wrote:Show nested quote +On July 28 2011 14:27 skyR wrote:
There's something fishy going on or something you're not telling us. 6GB / day is not possible with Skype and browsing unless you are doing video chat or streaming hours of 720p / 1080p content. I have over two thousand torrents seeding and can barely break 10GB / day on a 12/1 connection. It's 5-6GB a constantly on Skype in a voice chat, with a 720P stream open OR while playing starcraft for 2-10 hours/day depending on the day. It just seems odd to me that I'm using so much bandwidth while I'm idle. EDIT: THESE are the processes that I normally have running MINUS Skype. Anything look odd?
Well that would be the something you didn't tell us. The streaming of 720p for hours. One hour of streaming 720p content equates to around 1GB, if not more.
|
On July 28 2011 04:47 Scrubington wrote:
I closed all programs in the task manager via the process tab that use bandwidth and Net Meter was still telling me that I was using upto 1 MB down/500KB UP almost every other minute.
Over the course of 3:00 minutes I had used about 5 MB down and 1 MB up with absolutely no programs running that use bandwidth.
On July 28 2011 12:44 Scrubington wrote:
Skype apparently uses up a TON of bandwidth, other than that I don't know. I'm still using 5 GB-6GB a day, any suggestions on how to cut down on bandwidth usage?
6MB (total up&down) in 3 minutes is very different than the 5–6GB per day you said. I presume with the 5–6 GB you meant gigabits, but even if it was gigabytes it wouldn't match.
6 megabytes over 3 minutes is equal to 23 gigabits per day (or a bit under 3 gigabytes per day)
The good news is that it's downloading more than it's uploading. The bad news is that it still seems to be uploading a lot. Not sure why that much upload or download would be used by a malicious program.
If you didn't know, you can monitor total transferred up & down traffic through windows quite easily. While it doesn't help your problem, it should help you keep track of the bandwidth accurately.
W7/vista: Network and sharing center > change adapter settings> right click the connection>status
XP: control panel> network connections> right click connection>status
Any version of windows: just right click the network icon on the taskbar if you have it there and select status
Anyway, as a preliminary step I recommend you use two utilities:
- TCPview (maybe not necessary if comodo FW is showing all your connections already)
- Process Explorer
Process explorer is a excellent (IMO mandatory) replacement to the default windows task manager. TCPview will list all incoming and outgoing connections from the PC, and generally list the associated program controlling that connection. Comodo firewall may be doing just as good or better of a job for that though (haven't used it)
Using process explorer, you want to close all background processes that you do not recognize as being windows-native. This may take some time if you are not familiar with windows. Sometimes viruses may even be using windows processes (something I seemingly encountered, although it may have been some sort of windows malfunction) so be wary of that as well.
Not necessary step but recommended:
At this point, it would be good to restart process explorer, and look at the IO history. Over several minutes, hover your mouse over the graph, and look at the processes which are causing IO spikes. These IO spikes may or may not (most likely not) be related to network traffic, but they could still be an issue.
You can also look for any CPU spikes, but should look at the process list (CPU column) for that instead of the graph.
Now that you have as many programs as possible closed, run TCPview (and/or comodo FW) and look at your connections.
You should just see some windows and/or or system connections (system, svchost, etc.)
If you don't get any overall traffic from Comodo/Windows network connection status with all background processes closed, then start selectively running some of them, and see if the traffic goes up.
|
Check that Skype isn't using you as a super node.
Google it, I don't use Skype anymore but its something ive encountered before.
|
NetLimiter (Demo) shows you which processes use how much of the bandwidth.
|
On July 28 2011 17:32 FeiLing wrote:
NetLimiter (Demo) shows you which processes use how much of the bandwidth.
I'm more of a fan of Net Balancer ^^;
|
I know it seems silly but to rule out someone hijacking your wireless just check your usage for being idle for 10 mins (which you already know), then turn off your comp for that long and see if it went up or stayed the same.
Something else to look for would be a program perpetually trying to update itself by downloading and deleting the update in the background.
A safe bet would be to stop all network services in your msconfig, shouldn't have them on if you don't need them.
Another test you might try is to create a guest account on your computer and log on to that and see if it's still leaking, might provide insight on the impact of certain installed software.
|
Its justintv. Atleast the 1.2 GB in is justintv, so its probably a stream.
|
|
|
|
|
|
EPT
