Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




5096 posts

Uber Geek
+1 received by user: 123

Trusted

# 18714 21-Jan-2008 08:44
Send private message

Started checking my usage more carefully since it seemed TCL thought I was using much more than I thought.  Discovered that at about 2am each day there is around that time upwards of 800Mb downloads taking place!  Since I do have PC's on all the time (my server and PVR) thought it could be a trojan, virus or something.

I also have wireless and out of interest changed the WEP code in case it was cracked but the downloads were still there the following day. Unlikely there is somebody in my neighbourhood stealing wireless given it only occurs at 2am.

Haven't been able to isolate it to a machine yet (can only one of two) but out interest installed Zonalarm on both to see if any application would try to access the Internet that was not authorised (ZA would ask for permission). No alarms but still the usage was there. No virus on either machine that AVG could detect but not sure AVG can detect trojans.

Last night turned off the cable modem before hitting the sack. Usage dropped but still 8Mb at 2am which I would have thought was impossible.

Next step I guess is to ask TCL for network logs but I am not sure they can do that.

Anybody with any ideas?  Is there some tool I could download to access network traffic stats?

Thanks

Larry




Staying in Wellington. Check out my AirBnB in the Wellington CBD.  https://www.airbnb.co.nz/rooms/32019730  Mention GZ to get a 10% discount

 

System One: Popcorn Hour A200,  PS3 SuperSlim, NPVR and Plex Server running on Gigabyte Brix (Windows 10 Pro), Sony BDP-S390 BD player, Pioneer AVR, Raspberry Pi running Kodi and Plex, Panasonic 60" 3D plasma, Google Chromecast

System Two: Popcorn Hour A200 ,  Oppo BDP-80 BluRay Player with hardware mode to be region free, Vivitek HD1080P 1080P DLP projector with 100" screen, Denon AVRS730H 7.2 Channel Dolby Atmos/DTS-X AV Receiver, Samsung 4K player, Google Chromecast, Odroid C2 running Kodi and Plex

 

 


Create new topic

kdn

198 posts

Master Geek
+1 received by user: 6


  # 106476 24-Jan-2008 10:43
Send private message

Just a point, on the usage meters they state that the charts can be out of date by 6 hours, its posisble you are doing traffic during th eevening and its reporting it as 2am.. also if your running windows check what your automatic update settings are.. that could explain the traffic usage..

Flamer.

27906 posts

Uber Geek
+1 received by user: 7390

Moderator
Trusted
Biddle Corp
Lifetime subscriber

  # 106477 24-Jan-2008 10:52
Send private message

kdn: Just a point, on the usage meters they state that the charts can be out of date by 6 hours, its posisble you are doing traffic during th eevening and its reporting it as 2am.. also if your running windows check what your automatic update settings are.. that could explain the traffic usage..

Flamer.


The timestamp on the charts should be correct. The 6 hours refers to the time it may take to update to reflect your actual usage.

 
 
 
 


BDFL - Memuneh
63652 posts

Uber Geek
+1 received by user: 14111

Administrator
Trusted
Geekzone
Lifetime subscriber

# 106493 24-Jan-2008 12:19
Send private message

And you don't have a FTP server open?

I noticed a friend's box once having spikes in traffic - mainly uploads but then some downloads. It happened that he had FTP turned on, with anonymous access for read and write.

We found a few movies uploaded to his PC and obviously people downloading from there. Everything stopped once the anonymous access to the FTP server was closed.






5096 posts

Uber Geek
+1 received by user: 123

Trusted

  # 106501 24-Jan-2008 13:18
Send private message

No FTP server running. Anyway the traffic is shown as all downloads, no uploads so unless my machine is doing phantom downloads I don't know about, I am at a loss.

Shut off the modem and still saw traffic at that time - albeit below 1Mb. Still I should see no traffic at all if the modem is turned off. That is strange.

Next step is to see which PC it's coming from (could either be my file server or the PVR, both of which are usually on all the time). Both have Zonealarm installed and regular virus checking.




Staying in Wellington. Check out my AirBnB in the Wellington CBD.  https://www.airbnb.co.nz/rooms/32019730  Mention GZ to get a 10% discount

 

System One: Popcorn Hour A200,  PS3 SuperSlim, NPVR and Plex Server running on Gigabyte Brix (Windows 10 Pro), Sony BDP-S390 BD player, Pioneer AVR, Raspberry Pi running Kodi and Plex, Panasonic 60" 3D plasma, Google Chromecast

System Two: Popcorn Hour A200 ,  Oppo BDP-80 BluRay Player with hardware mode to be region free, Vivitek HD1080P 1080P DLP projector with 100" screen, Denon AVRS730H 7.2 Channel Dolby Atmos/DTS-X AV Receiver, Samsung 4K player, Google Chromecast, Odroid C2 running Kodi and Plex

 

 


2483 posts

Uber Geek
+1 received by user: 4

Trusted

  # 106631 24-Jan-2008 22:12
Send private message

Either:
  • TelstraClear has a weird counting error
    -- OR --
  • Someone's possibly tapping into your connection
Those are the two I could ever possibly think of.




Find me on Twitter!

I posted 1, 2 x 10^3 times!

196 posts

Master Geek
+1 received by user: 10


  # 107180 28-Jan-2008 14:36
Send private message

I have seen similar problems from Norton Anti-Virus trying (and failing) to update its virus defn's.

2483 posts

Uber Geek
+1 received by user: 4

Trusted

  # 107181 28-Jan-2008 14:43
Send private message

Actually, that reminds me.

Windows Automatic Updates are by default set at 2am. The odd thing is usually they have a huge update once and then most updates are small, which doesn't seem to account for the 'huge' usage every day.




Find me on Twitter!

I posted 1, 2 x 10^3 times!

 
 
 
 




5096 posts

Uber Geek
+1 received by user: 123

Trusted

  # 107186 28-Jan-2008 15:21
Send private message

Well I have tracked it down to one machine since I turned all the others off! Last night it was 1.5Gb. And there was little or no uploads. I have run anti virus checking etc on the machine and installed Zone Alrm but nothing showed up. It could be a Trojan but the question is, what sort of Trojan sits around and just downloads and doesn't do any uploads?




Staying in Wellington. Check out my AirBnB in the Wellington CBD.  https://www.airbnb.co.nz/rooms/32019730  Mention GZ to get a 10% discount

 

System One: Popcorn Hour A200,  PS3 SuperSlim, NPVR and Plex Server running on Gigabyte Brix (Windows 10 Pro), Sony BDP-S390 BD player, Pioneer AVR, Raspberry Pi running Kodi and Plex, Panasonic 60" 3D plasma, Google Chromecast

System Two: Popcorn Hour A200 ,  Oppo BDP-80 BluRay Player with hardware mode to be region free, Vivitek HD1080P 1080P DLP projector with 100" screen, Denon AVRS730H 7.2 Channel Dolby Atmos/DTS-X AV Receiver, Samsung 4K player, Google Chromecast, Odroid C2 running Kodi and Plex

 

 


425 posts

Ultimate Geek


  # 107361 29-Jan-2008 11:56
Send private message

If I were you and didn't want to wait around until 2am to find out which process was causing the problem, I'd set up a batch job to run netstat every minute from say 1:50am to 2:10am, dumping the results into a log file.  Netstat lists all processes that have a network connection.  If you use the -ano parameters, it will tell you the process ID and if the connection is active (ESTABLISHED).

To translate the PIDs into process names, you could probably use pslist or something similar.  You might need to schedule that as well in case the process starts, does its downloading and then terminates.

Depending on how many network-connected processes you have, you should be able to track down which one is doing the downloading.  From there, google it to find out what it is.


2721 posts

Uber Geek
+1 received by user: 1233

Trusted
Lifetime subscriber

  # 107380 29-Jan-2008 13:20
Send private message

You could always use a tool like wireshark aka ethereal to sniff the network and see what traffic is being created.

I would suspect it's either the automatic patch downloader from Microsoft trying and failing to download patches, or some anti-virus trying to get the latest updates and retrying and failing.

Wireshark is pretty easy to setup and just capture everything for ~400MB or so then I would happy read the trace and tell you what was going on if you wanted.







5096 posts

Uber Geek
+1 received by user: 123

Trusted

  # 107388 29-Jan-2008 13:47
Send private message

Jonc/BarTender, all good suggestions. Might have a bash at each of them and see what's going on. I was also when I had the time, going to ask TCL if they could provide IP logs of traffic but that might be a big ask!




Staying in Wellington. Check out my AirBnB in the Wellington CBD.  https://www.airbnb.co.nz/rooms/32019730  Mention GZ to get a 10% discount

 

System One: Popcorn Hour A200,  PS3 SuperSlim, NPVR and Plex Server running on Gigabyte Brix (Windows 10 Pro), Sony BDP-S390 BD player, Pioneer AVR, Raspberry Pi running Kodi and Plex, Panasonic 60" 3D plasma, Google Chromecast

System Two: Popcorn Hour A200 ,  Oppo BDP-80 BluRay Player with hardware mode to be region free, Vivitek HD1080P 1080P DLP projector with 100" screen, Denon AVRS730H 7.2 Channel Dolby Atmos/DTS-X AV Receiver, Samsung 4K player, Google Chromecast, Odroid C2 running Kodi and Plex

 

 




5096 posts

Uber Geek
+1 received by user: 123

Trusted

  # 107674 31-Jan-2008 07:16
Send private message

The plot thickens.  Last night I turned off the cable modem. Yet when I checked usage today there was a 128Mb usage between 12 and 2am. I wouildn't have thought this was possible!  Maybe it's a TCL billing issue? Time to call and see what resolution I get from them.




Staying in Wellington. Check out my AirBnB in the Wellington CBD.  https://www.airbnb.co.nz/rooms/32019730  Mention GZ to get a 10% discount

 

System One: Popcorn Hour A200,  PS3 SuperSlim, NPVR and Plex Server running on Gigabyte Brix (Windows 10 Pro), Sony BDP-S390 BD player, Pioneer AVR, Raspberry Pi running Kodi and Plex, Panasonic 60" 3D plasma, Google Chromecast

System Two: Popcorn Hour A200 ,  Oppo BDP-80 BluRay Player with hardware mode to be region free, Vivitek HD1080P 1080P DLP projector with 100" screen, Denon AVRS730H 7.2 Channel Dolby Atmos/DTS-X AV Receiver, Samsung 4K player, Google Chromecast, Odroid C2 running Kodi and Plex

 

 


425 posts

Ultimate Geek


  # 107686 31-Jan-2008 08:44
Send private message

That's got to be a TCL billing issue then.


2721 posts

Uber Geek
+1 received by user: 1233

Trusted
Lifetime subscriber

  # 107687 31-Jan-2008 08:45
Send private message

lchiu7: Jonc/BarTender, all good suggestions. Might have a bash at each of them and see what's going on. I was also when I had the time, going to ask TCL if they could provide IP logs of traffic but that might be a big ask!


One thing TCL could provide in the days of the old billing system was ammount of traffic from IP address A - B... during a set period.  However I think that all went by the wayside when they moved to their new billing system... much like the 10% change for national traffic over internation traffic.

Will get onto your trace on Friday when I am back in wgtn.





Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Xero announces new smarter tools, push into the North American market
Posted 19-Jun-2019 17:20


New report by Unisys shows New Zealanders want action by social platform companies and police to monitor social media sites
Posted 19-Jun-2019 17:09


ASB adds Google Pay option to contactless payments
Posted 19-Jun-2019 17:05


New Zealand PC Market declines on the back of high channel inventory, IDC reports
Posted 18-Jun-2019 17:35


Air New Zealand uses drones to inspect aircraft
Posted 17-Jun-2019 15:39


TCL Electronics launches its first-ever 8K TV
Posted 17-Jun-2019 15:18


E-scooter share scheme launches in Wellington
Posted 17-Jun-2019 12:34


Anyone can broadcast with Kordia Pop Up TV
Posted 13-Jun-2019 10:51


Volvo and Uber present production vehicle ready for self-driving
Posted 13-Jun-2019 10:47


100,000 customers connected to fibre broadband network through Enable
Posted 13-Jun-2019 10:35


5G uptake even faster than expected
Posted 12-Jun-2019 10:01


Xbox showcases 60 anticipated games
Posted 10-Jun-2019 20:24


Trend Micro Turns Public Hotspots into Secure Networks with WiFi Protection for Mobile Devices
Posted 5-Jun-2019 13:24


Bold UK spinoff for beauty software company Flossie
Posted 2-Jun-2019 14:10


Amazon Introduces Echo Show 5
Posted 1-Jun-2019 15:32



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.