How Do I Know What It's Downloading?

[mcdhu]

When surfing around on the trusty laptop I noticed that the lights on the router were flashing as they do when downloading something. Switched off the wireless and the flashing stopped. Switched it on again and it starts. Ctr Alt Del doesn't show up anything obvious.

So my question is how can I tell what it is downloading?

Dell Inspiron Laptop running Win Xp SP3, AOL BB, Netgear DG834G v3 with the latest firmware.

Have looked via PC Tools Spyware and Antivirus, Reg Mechanic, Malwarebytes and fired up windows defender for a look too. Nothing untoward.

[MacBoero]

There is always going to be a certain amount of network traffic. All sorts of network management packets flitting around the network, and the like. Also the task manager is not a good way of working out what is causing network traffic, as a task using a tiny fraction of CPU resource can cause a lot of network traffic.

Being Windows I suspect it is trawling the Microsoft website for Online Updates and downloading them in the background.

[Saab Dastard]

Can you narrow it down a bit?

Is the traffic just wifi traffic between PC and router / access point (and other PCs), or is it going out to the internet?

It's easy for me to see, because my cable modem is separate from the router. No flashing lights on cable modem = no internet activity, but there may still be traffic on the LAN, between PCs, so flashing lights on the wifi router.

Windows is "chatty", shall we say! Especially with things like UPNP and Bonjour, to mention but a couple.

I rarely see internet traffic that isn't directly associated with an "interactive" internet session.

But then I don't allow anything to auto-update, except Sophos (and that only at startup).

SD

[mad_jock]

Windows is "chatty", shall we say!

It has network diaoreahia pretty much constantly.

In the old days of NetBeUI and Apple talk a couple of machines could saturate a whole subnet if some idiot tried to plug them into a managed network without talking to the sys admin. It was one of the factors we used to watch for to spot when users had plugged thier own laptops in. I could never be bothered arguing so I used to just ban the offening MAC address from the DHCP server and switches/routers.

You can cut the traffic down by going in and turning off several services but in your situation I would just leave it as it is. Its one thing spending a couple of days getting the perfect machine when your going to roll out a couple of thousand installations but for a one off its not really doing any harm on its own ickle subnet

[DeeJayEss]

If it's the wireless router you're concerned about, I recommend you download yourself something like Wireshark (go to insecure.org, they have a wonderful selection of computer security tools to choose from) and analyse a set of packets over a given time. You'll get an idea of what sort of network traffic is being requested and sent, by which computer or device, and be able to make a proper judgement on whether everything is okay.

[mcdhu]

Ok guys thank you for the input; the message seems to be to leave it alone to 'chat' - assuming all the protections are in place, which they are.

Happy new year
mcdhu

[moona]

if you run "netstat -b -v" from a command prompt on the pc it will show you what processes are making remote connections from your machine.

There is probably a nice gui app that shows the same info but in a nicer format.

[Ancient Observer]

mcdhu

I have the Netgear DG834G v2, with its original firmware. (I'm too afraid to update it). The little men inside it have always turned the lights on and off on a frequent basis, mainly from the Netgear to the Internet, less frequently from it to the attached pc.s. (1 cat 5, 1 thru the elec cable, (Homeplug) and 2 wi-fi.)
I investigated it once, about 18 months ago, and nothing untoward was going on.
The flashing lights however, were a pain, so I re-jigged the wiring to ensure that I can only see the Netgear when I really have to. It's hidden behind the screen of my study's desktop. The little men can flash the lights on and off as much as they want.
With a very large amount of "touch wood", no pc.s infected with anything so far, touch wood.

[mcdhu]

Moona - neat trick, thanks for that!

Ancient Observer - thanks for that!
I'm a bit of a luddite as far as 'A' level IT is concerned, but, with a little encouragement from a mate, I took to updating the firmware and it paid off last time. The router was showing about 7mbps, the hard wired PC was showing about 5mbps but this trusty old Dell Inspiron Laptop showed a wireless 2.5mbps. With the latest firmware update, that shot up to almost the same as the PC ie 5-ish mbps. Now this could have been absolute coincidence, but nothing else had changed!! As long as you stich to the clear instructions on Netgear's website and make a backup before you start, I found it straightforward.

Cheers
mcdhu

[The late XV105]

I second Wireshark, which I installed after posting a question here asking for help to reassure myself that an unintentionally externally open FTP port (only for a few minutes, but it drew an unwanted external connection) on my NAS hadn't resulted in something heinous being installed that would try to get out back to base.

Nothing had been installed as it happens, but looking at the volume and type of network traffic was a real eye opener and actually fascinating. Even the "Hello, I'm 192.168.0.23. Is anybody else there?" Followed by the barrage of replies, followed by one of the other devices initiating the same question shortly afterwards, followed by the barrage of replies (I have something like a dozen devices on the Gigabit wired and 802.11G wireless network at home).

I am pretty comfortable with configuring computers and networks for SOHO use but cutting and pasting snippets of some of the internal network traffic reported by Wireshark in to Google usually gave the answer as to what it was about. This exercise also gave me a tiny, tiny, glimpse in to a world that I take for granted.