PDA

View Full Version : Something hitting the net every 60s



RandomUser
2009-11-26, 22:03
Hello

For some days now, I've noticed that the network light goes on more often than usual. I normally don't think much of it because nowadays I mostly use the computer for browsing, and also because I know that Windows, AVG, Java, and a few others check for updates occasionally.

I've now decided to look closer on it. The network light goes on exactly every 60 seconds. I'm a little annoyed at Windows. In Windows 98, I would know the exact moment there was traffic. Now, a dumb animation is displayed and I don't know exactly how long does this traffic last. This is Vista, all I can say is that the two little lights alternate twice when this happens (a, b, a, b, off).

I created a shortcut to run Task Manager as administrator, so I can see all tasks for all users as soon as I launch it. After leaving Task Manager running for a while, regardless of whether it's after just having restarted the computer, or after using the browser and closing it, I'm not able to spot what the heck hits the net so much (no strange exe pops up). On the networking tab, network utilization says 0.01% at the moment the lights blink, and goes back to 0% after a short while (a second or two? I haven't checked).

I have AVG and Spybot, and always keep it up to date. I have run both of them and nothing is detected.

If it helps any, I've been using computers for a long time now. May I ask-- what can I do to help identify the cause of this? How can I know more about the traffic that goes on? Is there a way to see a list of connections, their hostname, IP, port, etc? Thank you very much.

Tom.K
2009-11-26, 22:24
You can use TCPView for monitoring connections:
http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx

RandomUser
2009-12-04, 13:38
OK, I've been using TCPView for a while. Before getting to the main point, I noticed that clicking "Show Unconnected Endpoints (CTRL+U)" crashes the program. Is the program known to be broken? Or is then something wrong with my computer in particular?

Right now what was generating traffic was due to an svchost.exe on port 5355, double-checked on TCPView and netstat. Upon looking at both the services file and TCPView, apparently 5535 == LLMNR some protocol related to DNS. I'm not sure how it works exactly. Traffic seems to occur every 60 seconds, but sometimes it doesn't happen.

What does LLMNR do? Is it necessary? Why does it generate so much traffic?

Thank you.

bitman
2009-12-04, 17:40
http://www.slickit.ca/2009/11/llmnr-another-reason-to-upgrade.html

Bitman

TR098
2009-12-05, 20:04
それを鳴る実際に悪く感動させなさいしかしコンピュータは破壊された毎日を得ている

wow that sounds really bad but computers are getting destroyed everyday