Bluetooth Network Access bandwidth wasted and other troubles

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › Bluetooth Network Access bandwidth wasted and other troubles

mja_geekzone

2 posts

Wannabe Geek
Inactive user

#853 27-Dec-2003 07:21

Hi,
This is my problem with a Bluetooth Network Access:

I have a laptop with Windows 2000 WS. The Bluetooth software is Widcomm version 1.3.2.7
Te problem is that it uses permanently more than 15% of the total bandwidth doing ping (ICMP type 8) to non-existing, self-generated ip addresses.
Also, it gives a lot of useless work to the router computer.
Here is the trace (it emits aprox 100 ping-packets by second) :

...
[25/Dec/2003 16:33:00] Packet filter: ACL 1:0 Bluetooth PAN Driver: drop packet in id=240922 : ICMP 192.168.20.11 -> 192.168.231.253 type 8 code 0
[25/Dec/2003 16:33:00] Packet filter: ACL 1:0 Bluetooth PAN Driver: drop packet in id=240924 : ICMP 192.168.20.11 -> 192.168.231.254 type 8 code 0
[25/Dec/2003 16:33:00] Packet filter: ACL 1:0 Bluetooth PAN Driver: drop packet in id=240925 : ICMP 192.168.20.11 -> 192.168.231.255 type 8 code 0
[25/Dec/2003 16:33:00] Packet filter: ACL 1:0 Bluetooth PAN Driver: drop packet in id=240926 : ICMP 192.168.20.11 -> 192.168.232.0 type 8 code 0
[25/Dec/2003 16:33:00] Packet filter: ACL 1:0 Bluetooth PAN Driver: drop packet in id=240929 : ICMP 192.168.20.11 -> 192.168.232.1 type 8 code 0
[25/Dec/2003 16:33:00] Packet filter: ACL 1:0 Bluetooth PAN Driver: drop packet in id=240930 : ICMP 192.168.20.11 -> 192.168.232.2 type 8 code 0
[25/Dec/2003 16:33:00] Packet filter: ACL 1:0 Bluetooth PAN Driver: drop packet in id=240931 : ICMP 192.168.20.11 -> 192.168.232.3 type 8 code 0
...

Could someone tell me how to disable this behavior or at least reduce the wasted bandwidth.
Thanks

freitasm

BDFL - Memuneh
79253 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2542 27-Dec-2003 10:02

Any other devices nearby? What else you have in this network?

mja_geekzone

2 posts

Wannabe Geek
Inactive user

#2550 27-Dec-2003 23:07

Many Thanks for your Reply.
I've concluded my problem is caused by a worm:

...
(Taken from "Excessive and Constant Ping Alerts" By Ryan Naraine )

It may be a friendly worm with good intentions but the W32.Welchia.Worm squirming through corporate networks has become a nightmare for IT administrators already struggling to clean up last week's "Blaster" virus.

What's worse, security experts say, is that the Welchia worm is using two separate vulnerabilities to infect and wreak havoc on networks around the world. In addition to sneaking in via the DCOM RPC vulnerability in some versions of Microsoft's Windows operating systems, Welchia propagates through TCP port 80 on Microsoft IIS 5.0 systems that have not patched the Microsoft Windows WebDav (ntdll.dll) Buffer Overflow Vulnerability.
...

I've found and deleted this worm on my system (Win2000 and IE5.0).

Many Thanks again

freitasm

BDFL - Memuneh
79253 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2551 27-Dec-2003 23:17

This is a good posting. Other folks might have this too and are not aware. Thanks for the followup!