Home All Groups Group Topic Archive Search About

Wired 100mb network connection constantly "sends"

Author
17 Oct 2006 3:12 AM
Tommy Jones
I have Windows XP, SP2 with all updates applied (running on a Sony Viao with
512mb, a 2.4 P4 and 60GB).  I connect to a USR 54g router (both wirelessly
(@125mb) and wired (@100mb)), but the wired connnection numbers show an
excessive (and I mean excessive) number of "sends."  For example, after being
online for 52 minutes, here are the stats when I open up my network
connections:
Wireless:   Sent =               1,608,811      Received = 8,065,967
Wireed:     Sent = 17,732,689,652,039      Received =     14,535

Clearly my wireless connection is doing the bulk of the transmissions, but
why does my wired "sent" number esclate so high, so fast (e.g., they reach a
billion+ in the first few minutes after powering up).

I have loaded Port Explorer and Process Explorer and neither shows any
unusual activity.  I'm also update on my Norton Anti-Virus (i.e., none found)
and Spy Sweeper anti-spyware.

This has been going on for months, and the machine is slowing down more and
more.

Any thoughts????  This one is a real brain-buster!

p.s.  My wired NIC is the Intel PRO/100 VE Adapter and my wireless NIC is a
US Robotics 802.11G Wireless Turbo Adapter.  The router is a US Robotics
802.11g Wireless Turbo Router (both adapter and router firmware upgraded to
provide 125mb) and I've even put in a different router, but get the same
results.

Author
17 Oct 2006 3:24 AM
Chuck
On Mon, 16 Oct 2006 20:12:02 -0700, Tommy Jones
<TommyJo***@discussions.microsoft.com> wrote:

Show quoteHide quote
>I have Windows XP, SP2 with all updates applied (running on a Sony Viao with
>512mb, a 2.4 P4 and 60GB).  I connect to a USR 54g router (both wirelessly
>(@125mb) and wired (@100mb)), but the wired connnection numbers show an
>excessive (and I mean excessive) number of "sends."  For example, after being
>online for 52 minutes, here are the stats when I open up my network
>connections:
>Wireless:   Sent =               1,608,811      Received = 8,065,967
>Wireed:     Sent = 17,732,689,652,039      Received =     14,535
>
>Clearly my wireless connection is doing the bulk of the transmissions, but
>why does my wired "sent" number esclate so high, so fast (e.g., they reach a
>billion+ in the first few minutes after powering up).
>
>I have loaded Port Explorer and Process Explorer and neither shows any
>unusual activity.  I'm also update on my Norton Anti-Virus (i.e., none found)
>and Spy Sweeper anti-spyware.
>
>This has been going on for months, and the machine is slowing down more and
>more.
>
>Any thoughts????  This one is a real brain-buster!
>
>p.s.  My wired NIC is the Intel PRO/100 VE Adapter and my wireless NIC is a
>US Robotics 802.11G Wireless Turbo Adapter.  The router is a US Robotics
>802.11g Wireless Turbo Router (both adapter and router firmware upgraded to
>provide 125mb) and I've even put in a different router, but get the same
>results.

Tommy,

That is a pretty large number.  Does Port Explorer show which process is running
the numbers up?  The Sent and Received columns can be pretty useful here.

--
Cheers,
Chuck, MS-MVP [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My        email         is          AT         DOT
   actual       address    pchuck       mvps        org.
Author
17 Oct 2006 11:53 PM
Tommy Jones
No, Port Explorer doesn't show any excessive activity.  It's as if the
counter in the display is just incrementing itself.  When I have a Port
Explorer windows open right next to the "Local LAN Connection" Status window,
I can watch the number in the "status" window incrementing at a tremendous
rate (i.e., a couple of a million in less than 60 seconds), yet Port Explorer
only shows 600-700 bytes being sent.

A real puzzler.

Tommy
=======

Show quoteHide quote
"Chuck" wrote:

> On Mon, 16 Oct 2006 20:12:02 -0700, Tommy Jones
> <TommyJo***@discussions.microsoft.com> wrote:
>
> >I have Windows XP, SP2 with all updates applied (running on a Sony Viao with
> >512mb, a 2.4 P4 and 60GB).  I connect to a USR 54g router (both wirelessly
> >(@125mb) and wired (@100mb)), but the wired connnection numbers show an
> >excessive (and I mean excessive) number of "sends."  For example, after being
> >online for 52 minutes, here are the stats when I open up my network
> >connections:
> >Wireless:   Sent =               1,608,811      Received = 8,065,967
> >Wireed:     Sent = 17,732,689,652,039      Received =     14,535
> >
> >Clearly my wireless connection is doing the bulk of the transmissions, but
> >why does my wired "sent" number esclate so high, so fast (e.g., they reach a
> >billion+ in the first few minutes after powering up).
> >
> >I have loaded Port Explorer and Process Explorer and neither shows any
> >unusual activity.  I'm also update on my Norton Anti-Virus (i.e., none found)
> >and Spy Sweeper anti-spyware.
> >
> >This has been going on for months, and the machine is slowing down more and
> >more.
> >
> >Any thoughts????  This one is a real brain-buster!
> >
> >p.s.  My wired NIC is the Intel PRO/100 VE Adapter and my wireless NIC is a
> >US Robotics 802.11G Wireless Turbo Adapter.  The router is a US Robotics
> >802.11g Wireless Turbo Router (both adapter and router firmware upgraded to
> >provide 125mb) and I've even put in a different router, but get the same
> >results.
>
> Tommy,
>
> That is a pretty large number.  Does Port Explorer show which process is running
> the numbers up?  The Sent and Received columns can be pretty useful here.
>
> --
> Cheers,
> Chuck, MS-MVP [Windows - Networking]
> http://nitecruzr.blogspot.com/
> Paranoia is not a problem, when it's a normal response from experience.
> My        email         is          AT         DOT
>    actual       address    pchuck       mvps        org.
>
Author
18 Oct 2006 12:31 AM
Chuck
On Tue, 17 Oct 2006 16:53:02 -0700, Tommy Jones
<TommyJo***@discussions.microsoft.com> wrote:

Show quoteHide quote
>"Chuck" wrote:
>
>> On Mon, 16 Oct 2006 20:12:02 -0700, Tommy Jones
>> <TommyJo***@discussions.microsoft.com> wrote:
>>
>> >I have Windows XP, SP2 with all updates applied (running on a Sony Viao with
>> >512mb, a 2.4 P4 and 60GB).  I connect to a USR 54g router (both wirelessly
>> >(@125mb) and wired (@100mb)), but the wired connnection numbers show an
>> >excessive (and I mean excessive) number of "sends."  For example, after being
>> >online for 52 minutes, here are the stats when I open up my network
>> >connections:
>> >Wireless:   Sent =               1,608,811      Received = 8,065,967
>> >Wireed:     Sent = 17,732,689,652,039      Received =     14,535
>> >
>> >Clearly my wireless connection is doing the bulk of the transmissions, but
>> >why does my wired "sent" number esclate so high, so fast (e.g., they reach a
>> >billion+ in the first few minutes after powering up).
>> >
>> >I have loaded Port Explorer and Process Explorer and neither shows any
>> >unusual activity.  I'm also update on my Norton Anti-Virus (i.e., none found)
>> >and Spy Sweeper anti-spyware.
>> >
>> >This has been going on for months, and the machine is slowing down more and
>> >more.
>> >
>> >Any thoughts????  This one is a real brain-buster!
>> >
>> >p.s.  My wired NIC is the Intel PRO/100 VE Adapter and my wireless NIC is a
>> >US Robotics 802.11G Wireless Turbo Adapter.  The router is a US Robotics
>> >802.11g Wireless Turbo Router (both adapter and router firmware upgraded to
>> >provide 125mb) and I've even put in a different router, but get the same
>> >results.
>>
>> Tommy,
>>
>> That is a pretty large number.  Does Port Explorer show which process is running
>> the numbers up?  The Sent and Received columns can be pretty useful here.

>No, Port Explorer doesn't show any excessive activity.  It's as if the
>counter in the display is just incrementing itself.  When I have a Port
>Explorer windows open right next to the "Local LAN Connection" Status window,
>I can watch the number in the "status" window incrementing at a tremendous
>rate (i.e., a couple of a million in less than 60 seconds), yet Port Explorer
>only shows 600-700 bytes being sent.
>
>A real puzzler.

OK, Tommy,

And have you identified all of the processes that do show in Port Explorer, with
numbers increasing at any rate?

And if you can't reach a conclusion, I'd highly recommend HijackThis and expert
advice.  And BlackLight or Rootkit Revealer.
<http://nitecruzr.blogspot.com/2005/05/interpreting-hijackthis-logs-with.html>
http://nitecruzr.blogspot.com/2005/05/interpreting-hijackthis-logs-with.html
<http://nitecruzr.blogspot.com/2006/06/deeply-hidden-and-heavily-protected.html>
http://nitecruzr.blogspot.com/2006/06/deeply-hidden-and-heavily-protected.html

--
Cheers,
Chuck, MS-MVP [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My        email         is          AT         DOT
   actual       address    pchuck       mvps        org.
Author
19 Oct 2006 2:20 AM
Tommy Jones
Chuck,

I looked at the info in Port Explorer and it all looks okay, but I'll look
again.  And thanks for recommending the other two options.  Maybe one of them
will provide some insight.  I've seen a lot in my 30 years of doing this
stuff, but this one truly has me baffled.

Tommy
====

Show quoteHide quote
"Chuck" wrote:

> On Tue, 17 Oct 2006 16:53:02 -0700, Tommy Jones
> <TommyJo***@discussions.microsoft.com> wrote:
>
> >"Chuck" wrote:
> >
> >> On Mon, 16 Oct 2006 20:12:02 -0700, Tommy Jones
> >> <TommyJo***@discussions.microsoft.com> wrote:
> >>
> >> >I have Windows XP, SP2 with all updates applied (running on a Sony Viao with
> >> >512mb, a 2.4 P4 and 60GB).  I connect to a USR 54g router (both wirelessly
> >> >(@125mb) and wired (@100mb)), but the wired connnection numbers show an
> >> >excessive (and I mean excessive) number of "sends."  For example, after being
> >> >online for 52 minutes, here are the stats when I open up my network
> >> >connections:
> >> >Wireless:   Sent =               1,608,811      Received = 8,065,967
> >> >Wireed:     Sent = 17,732,689,652,039      Received =     14,535
> >> >
> >> >Clearly my wireless connection is doing the bulk of the transmissions, but
> >> >why does my wired "sent" number esclate so high, so fast (e.g., they reach a
> >> >billion+ in the first few minutes after powering up).
> >> >
> >> >I have loaded Port Explorer and Process Explorer and neither shows any
> >> >unusual activity.  I'm also update on my Norton Anti-Virus (i.e., none found)
> >> >and Spy Sweeper anti-spyware.
> >> >
> >> >This has been going on for months, and the machine is slowing down more and
> >> >more.
> >> >
> >> >Any thoughts????  This one is a real brain-buster!
> >> >
> >> >p.s.  My wired NIC is the Intel PRO/100 VE Adapter and my wireless NIC is a
> >> >US Robotics 802.11G Wireless Turbo Adapter.  The router is a US Robotics
> >> >802.11g Wireless Turbo Router (both adapter and router firmware upgraded to
> >> >provide 125mb) and I've even put in a different router, but get the same
> >> >results.
> >>
> >> Tommy,
> >>
> >> That is a pretty large number.  Does Port Explorer show which process is running
> >> the numbers up?  The Sent and Received columns can be pretty useful here.
>
> >No, Port Explorer doesn't show any excessive activity.  It's as if the
> >counter in the display is just incrementing itself.  When I have a Port
> >Explorer windows open right next to the "Local LAN Connection" Status window,
> >I can watch the number in the "status" window incrementing at a tremendous
> >rate (i.e., a couple of a million in less than 60 seconds), yet Port Explorer
> >only shows 600-700 bytes being sent.
> >
> >A real puzzler.
>
> OK, Tommy,
>
> And have you identified all of the processes that do show in Port Explorer, with
> numbers increasing at any rate?
>
> And if you can't reach a conclusion, I'd highly recommend HijackThis and expert
> advice.  And BlackLight or Rootkit Revealer.
> <http://nitecruzr.blogspot.com/2005/05/interpreting-hijackthis-logs-with.html>
> http://nitecruzr.blogspot.com/2005/05/interpreting-hijackthis-logs-with.html
> <http://nitecruzr.blogspot.com/2006/06/deeply-hidden-and-heavily-protected.html>
> http://nitecruzr.blogspot.com/2006/06/deeply-hidden-and-heavily-protected.html
>
> --
> Cheers,
> Chuck, MS-MVP [Windows - Networking]
> http://nitecruzr.blogspot.com/
> Paranoia is not a problem, when it's a normal response from experience.
> My        email         is          AT         DOT
>    actual       address    pchuck       mvps        org.
>
Author
19 Oct 2006 2:43 PM
Chuck
On Wed, 18 Oct 2006 19:20:02 -0700, Tommy Jones
<TommyJo***@discussions.microsoft.com> wrote:

Show quoteHide quote
>"Chuck" wrote:
>
>> On Tue, 17 Oct 2006 16:53:02 -0700, Tommy Jones
>> <TommyJo***@discussions.microsoft.com> wrote:
>>
>> >"Chuck" wrote:
>> >
>> >> On Mon, 16 Oct 2006 20:12:02 -0700, Tommy Jones
>> >> <TommyJo***@discussions.microsoft.com> wrote:
>> >>
>> >> >I have Windows XP, SP2 with all updates applied (running on a Sony Viao with
>> >> >512mb, a 2.4 P4 and 60GB).  I connect to a USR 54g router (both wirelessly
>> >> >(@125mb) and wired (@100mb)), but the wired connnection numbers show an
>> >> >excessive (and I mean excessive) number of "sends."  For example, after being
>> >> >online for 52 minutes, here are the stats when I open up my network
>> >> >connections:
>> >> >Wireless:   Sent =               1,608,811      Received = 8,065,967
>> >> >Wireed:     Sent = 17,732,689,652,039      Received =     14,535
>> >> >
>> >> >Clearly my wireless connection is doing the bulk of the transmissions, but
>> >> >why does my wired "sent" number esclate so high, so fast (e.g., they reach a
>> >> >billion+ in the first few minutes after powering up).
>> >> >
>> >> >I have loaded Port Explorer and Process Explorer and neither shows any
>> >> >unusual activity.  I'm also update on my Norton Anti-Virus (i.e., none found)
>> >> >and Spy Sweeper anti-spyware.
>> >> >
>> >> >This has been going on for months, and the machine is slowing down more and
>> >> >more.
>> >> >
>> >> >Any thoughts????  This one is a real brain-buster!
>> >> >
>> >> >p.s.  My wired NIC is the Intel PRO/100 VE Adapter and my wireless NIC is a
>> >> >US Robotics 802.11G Wireless Turbo Adapter.  The router is a US Robotics
>> >> >802.11g Wireless Turbo Router (both adapter and router firmware upgraded to
>> >> >provide 125mb) and I've even put in a different router, but get the same
>> >> >results.
>> >>
>> >> Tommy,
>> >>
>> >> That is a pretty large number.  Does Port Explorer show which process is running
>> >> the numbers up?  The Sent and Received columns can be pretty useful here.
>>
>> >No, Port Explorer doesn't show any excessive activity.  It's as if the
>> >counter in the display is just incrementing itself.  When I have a Port
>> >Explorer windows open right next to the "Local LAN Connection" Status window,
>> >I can watch the number in the "status" window incrementing at a tremendous
>> >rate (i.e., a couple of a million in less than 60 seconds), yet Port Explorer
>> >only shows 600-700 bytes being sent.
>> >
>> >A real puzzler.
>>
>> OK, Tommy,
>>
>> And have you identified all of the processes that do show in Port Explorer, with
>> numbers increasing at any rate?
>>
>> And if you can't reach a conclusion, I'd highly recommend HijackThis and expert
>> advice.  And BlackLight or Rootkit Revealer.
>> <http://nitecruzr.blogspot.com/2005/05/interpreting-hijackthis-logs-with.html>
>> http://nitecruzr.blogspot.com/2005/05/interpreting-hijackthis-logs-with.html
>> <http://nitecruzr.blogspot.com/2006/06/deeply-hidden-and-heavily-protected.html>
>> http://nitecruzr.blogspot.com/2006/06/deeply-hidden-and-heavily-protected.html

>Chuck,
>
>I looked at the info in Port Explorer and it all looks okay, but I'll look
>again.  And thanks for recommending the other two options.  Maybe one of them
>will provide some insight.  I've seen a lot in my 30 years of doing this
>stuff, but this one truly has me baffled.
>
>Tommy
>====

If you don't see any numbers in Port Explorer to equal what you see in My
Network Connections, then you could well have a rootkit type malware in action.
And you will need expert security advice.

The hell of it is, the experts will probably advise you to "nuke and pave".
<http://en.wikipedia.org/wiki/Nuke_and_pave>
http://en.wikipedia.org/wiki/Nuke_and_pave

--
Cheers,
Chuck, MS-MVP [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My        email         is          AT         DOT
   actual       address    pchuck       mvps        org.