Way to Diagnose mystery net traffic.

This topic is locked from further discussion.

Avatar image for DerekLoffin
DerekLoffin

9095

Forum Posts

0

Wiki Points

0

Followers

Reviews: 47

User Lists: 0

#1  Edited By DerekLoffin
Member since 2002 • 9095 Posts

I got several PCs on network at home, and recently noticed that I was getting really laggy net performance. I traced this to one PC that is absolutely HAMMERING the router causing it to consistently lag every 3-10 seconds. Funny enough it isn't using much bandwidth. Most net usage won't notice this, but online games certainly do.

Now while working on this, I found that a safe mode start gets rid of the problem, but shutting down every task I could think that could be shut down would not fix it. I've run numerous scans on the system and nothing has shown anything suspicious and it was recently rebuilt. So short of another rebuild, does anybody know a good program to track down what is using the networking in this kind of burst fashion (or even better what may be the issue)? I suspect it is malware as I can't see any legitimate program using the network this stupidly, but I don't want to go through a whole rebuild just to find out it is something I've dumbly installed.

Avatar image for FelipeInside
FelipeInside

28548

Forum Posts

0

Wiki Points

0

Followers

Reviews: 0

User Lists: 0

#2 FelipeInside
Member since 2003 • 28548 Posts

@DerekLoffin said:

I got several PCs on network at home, and recently noticed that I was getting really laggy net performance. I traced this to one PC that is absolutely HAMMERING the router causing it to consistently lag every 3-10 seconds. Funny enough it isn't using much bandwidth. Most net usage won't notice this, but online games certainly do.

Now while working on this, I found that a safe mode start gets rid of the problem, but shutting down every task I could think that could be shut down would not fix it. I've run numerous scans on the system and nothing has shown anything suspicious and it was recently rebuilt. So short of another rebuild, does anybody know a good program to track down what is using the networking in this kind of burst fashion (or even better what may be the issue)? I suspect it is malware as I can't see any legitimate program using the network this stupidly, but I don't want to go through a whole rebuild just to find out it is something I've dumbly installed.

You can try Wireshark on the PC but you have to know a bit about networking to know what you're looking at.

If it was just recently rebuilt, another format and install might be your safest bet.

Avatar image for Gammit10
Gammit10

2397

Forum Posts

0

Wiki Points

0

Followers

Reviews: 119

User Lists: 2

#3  Edited By Gammit10
Member since 2004 • 2397 Posts

@DerekLoffin said:

Now while working on this, I found that a safe mode start gets rid of the problem

Sounds like you have an issue with something that safe mode eliminated your issue. So your'e issue is likely with a program that is set to auto-start, a non-microsoft service, or a bad/outdated third-party driver. My guess is the auto-start programs.

Avatar image for Arthas045
Arthas045

5800

Forum Posts

0

Wiki Points

0

Followers

Reviews: 2

User Lists: 0

#4 Arthas045
Member since 2005 • 5800 Posts

Do a selective startup through msconfig.

Avatar image for deactivated-6127ced9bcba0
deactivated-6127ced9bcba0

31700

Forum Posts

0

Wiki Points

0

Followers

Reviews: 1

User Lists: 0

#5  Edited By deactivated-6127ced9bcba0
Member since 2006 • 31700 Posts

Just reformat it. Unless you have something on there that you absolutely can't lose, there is no reason to hunt around and try and locate the problem.

Avatar image for JohnF111
JohnF111

14190

Forum Posts

0

Wiki Points

0

Followers

Reviews: 12

User Lists: 0

#6  Edited By JohnF111
Member since 2010 • 14190 Posts

Use a network scanner such as Nmap to determine what's running on your PC. Do this from a different PC, I found that sometimes on my PC there were torrent trackers constantly churning their way through some of my network data, took me a while to figure it out as it was always different IPs(duh) but eventually I noticed the IPs were all trackers I had on my bit torrent client. Nothing dangerous or suspicious about it just something I noticed.