Home All Groups Group Topic Archive Search About
Author
6 Jun 2009 4:28 PM
Peter Boulding
The setup: a WinXPSP3 PC connected to the internet via a network cable
linking its Realtek RTL8139 Family PCI network adaptor to a four-port
Netgear DG834G (v3--UK) wireless firewall ADSL router. Wireless capability
is not currently in use and is disabled; no other PC is currently connected
to the router.


The user (me): a novice as regards XP, networking, and ADSL.


The problem:

Sometimes, when I boot up the PC, only one network connection is
created--namely "Local Area Connection" (type 'LAN or High Speed Internet';
Device name 'Realtek RTL8139 Family PCI Fast Ethernet NIC'). When this
happens, all is well.

But sometimes, when I boot up the PC, a second network connection is also
created--namely "Internet Connection" (type: 'internet gateway'; Device name
'internet connection'). When this happens, the network card talks
incessantly to the router at a rate of approx. 39kbits/sec down, and
45kbits/sec up (measurements from Networx.exe, a freeware LAN monitor).

In either case I can access internet services, but in the latter case the
incessant chatter just never stops; heaven knows what the network card and
router are trying to tell each other. Every time this data flow appears on
the Networx graph I get the horrids in case some malware has taken over my
PC and is sending out a pile of spam or suchlike, although a check on the
internet connection's status display shows that the packets are only passing
between the two devices until I make use of an internet service such as the
web or check mail or suchlike.

I have repeatedly tried running the 'set up a home or small office network'
wizard but it appears to make no difference, regardless of which option I
choose.

XP's choice as regards whether or not to set up that second connection
appears to be quite random as far as I'm concerned... I'd be most grateful
for advice on how to solve this odd and slightly unnerving problem. Please
bear in mind that, although PC literate, I'm something of a novice in this
area.

--
Regards,   Peter Boulding
pjbnews1@UNSPAMpboulding.co.uk (to e-mail, remove "UNSPAM")
Fractal Music and Images: http://www.pboulding.co.uk/ and
http://www.soundclick.com/bands/default.cfm?bandID=794240&content=music

Author
6 Jun 2009 5:18 PM
Lem
Peter Boulding wrote:
Show quoteHide quote
> The setup: a WinXPSP3 PC connected to the internet via a network cable
> linking its Realtek RTL8139 Family PCI network adaptor to a four-port
> Netgear DG834G (v3--UK) wireless firewall ADSL router. Wireless capability
> is not currently in use and is disabled; no other PC is currently connected
> to the router.
>
>
> The user (me): a novice as regards XP, networking, and ADSL.
>
>
> The problem:
>
> Sometimes, when I boot up the PC, only one network connection is
> created--namely "Local Area Connection" (type 'LAN or High Speed Internet';
> Device name 'Realtek RTL8139 Family PCI Fast Ethernet NIC'). When this
> happens, all is well.
>
> But sometimes, when I boot up the PC, a second network connection is also
> created--namely "Internet Connection" (type: 'internet gateway'; Device name
> 'internet connection'). When this happens, the network card talks
> incessantly to the router at a rate of approx. 39kbits/sec down, and
> 45kbits/sec up (measurements from Networx.exe, a freeware LAN monitor).
>
> In either case I can access internet services, but in the latter case the
> incessant chatter just never stops; heaven knows what the network card and
> router are trying to tell each other. Every time this data flow appears on
> the Networx graph I get the horrids in case some malware has taken over my
> PC and is sending out a pile of spam or suchlike, although a check on the
> internet connection's status display shows that the packets are only passing
> between the two devices until I make use of an internet service such as the
> web or check mail or suchlike.
>
> I have repeatedly tried running the 'set up a home or small office network'
> wizard but it appears to make no difference, regardless of which option I
> choose.
>
> XP's choice as regards whether or not to set up that second connection
> appears to be quite random as far as I'm concerned... I'd be most grateful
> for advice on how to solve this odd and slightly unnerving problem. Please
> bear in mind that, although PC literate, I'm something of a novice in this
> area.
>

The "Internet Gateway" icon is a means of accessing and configuring your
router without having to use a browser to access its built-in web
configuration pages.  If you don't want it, go into your router's
configuration pages and disable UPnP (Universal Plug and Play).

Alternately, you can disable UPnP:

- Manually disable the UPnP device host service by typing "services.msc"
(without quotes) in Start > Run and set Startup Type to "Disabled."

- Use Steve Gibson's utility to do it: http://www.grc.com/unpnp/unpnp.htm



Probably more than you want to know:
Settings for minimizing periodic WAN traffic
http://support.microsoft.com/kb/819108
--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm
Author
6 Jun 2009 10:51 PM
Peter Boulding
On Sat, 06 Jun 2009 13:18:11 -0400, Lem <lemp40@unknownhost> wrote in
<#F#tErs5JHA.6***@TK2MSFTNGP02.phx.gbl>:

Show quoteHide quote
>Peter Boulding wrote:
>> The setup: a WinXPSP3 PC connected to the internet via a network cable
>> linking its Realtek RTL8139 Family PCI network adaptor to a four-port
>> Netgear DG834G (v3--UK) wireless firewall ADSL router. Wireless capability
>> is not currently in use and is disabled; no other PC is currently connected
>> to the router.
>>
>>
>> The user (me): a novice as regards XP, networking, and ADSL.
>>
>>
>> The problem:
>>
>> Sometimes, when I boot up the PC, only one network connection is
>> created--namely "Local Area Connection" (type 'LAN or High Speed Internet';
>> Device name 'Realtek RTL8139 Family PCI Fast Ethernet NIC'). When this
>> happens, all is well.
>>
>> But sometimes, when I boot up the PC, a second network connection is also
>> created--namely "Internet Connection" (type: 'internet gateway'; Device name
>> 'internet connection'). When this happens, the network card talks
>> incessantly to the router at a rate of approx. 39kbits/sec down, and
>> 45kbits/sec up (measurements from Networx.exe, a freeware LAN monitor).
>>
>> In either case I can access internet services, but in the latter case the
>> incessant chatter just never stops; heaven knows what the network card and
>> router are trying to tell each other. Every time this data flow appears on
>> the Networx graph I get the horrids in case some malware has taken over my
>> PC and is sending out a pile of spam or suchlike, although a check on the
>> internet connection's status display shows that the packets are only passing
>> between the two devices until I make use of an internet service such as the
>> web or check mail or suchlike.
>>
>> I have repeatedly tried running the 'set up a home or small office network'
>> wizard but it appears to make no difference, regardless of which option I
>> choose.
>>
>> XP's choice as regards whether or not to set up that second connection
>> appears to be quite random as far as I'm concerned... I'd be most grateful
>> for advice on how to solve this odd and slightly unnerving problem. Please
>> bear in mind that, although PC literate, I'm something of a novice in this
>> area.
>>
>
>The "Internet Gateway" icon is a means of accessing and configuring your
>router without having to use a browser to access its built-in web
>configuration pages. 

Hmm... It does let me display some very limited info from the router,
including the passage of packets between the router and my ISP's gateway,
and to "disable" it--which causes the router to disconnect my ADSL link, but
mostly it tells me I don't have permission; I have to use my browser to see
and change most router settings.

>If you don't want it, go into your router's
>configuration pages and disable UPnP (Universal Plug and Play).

OK ... have done, and this indeed has stopped the incessant data flow
between network card and router.

>Alternately, you can disable UPnP:
>
>- Manually disable the UPnP device host service by typing "services.msc"
>(without quotes) in Start > Run and set Startup Type to "Disabled."
>
>- Use Steve Gibson's utility to do it: http://www.grc.com/unpnp/unpnp.htm

Haven't tried disabling UPnP on the PC, having no idea what else that might
affect (or why I might want it in the future).

>Probably more than you want to know:
>Settings for minimizing periodic WAN traffic
>http://support.microsoft.com/kb/819108

Indeed: that KB article is talking about stuff I know damn all about.
Luckily it also seems to be pretty irrelevant to my setup, with XP Home; no
domain controller involved; no dialup or ISDN; and NetBIOS disabled.


Anyway: disabling the router's UPnP service has done the trick--for which my
grateful thanks--but I still wonder what the Hell could cause UPnP to need
to send non-stop traffic to the network card at a rate of 39kbits/sec and
cause the card to reply with an equally continuous 45kbits/sec.

--
Regards,   Peter Boulding
pjbnews1@UNSPAMpboulding.co.uk (to e-mail, remove "UNSPAM")
Fractal Music and Images: http://www.pboulding.co.uk/ and
http://www.soundclick.com/bands/default.cfm?bandID=794240&content=music
Author
7 Jun 2009 1:47 AM
Jack [MVP-Networking]
Hi
Quote: "If you haven't yet tackled the constant UPnP chatter on your
network, read on to discover what UPnP traffic is".
Continue here,
http://windowsitpro.com/article/articleid/26008/the-perils-of-upnp.html
Jack (MS, MVP-Networking)

Show quoteHide quote
"Peter Boulding" <pjbnews1@UNSPAMpboulding.co.uk> wrote in message
news:0jrl251jbl5kjdjpttnqc9lkr1jab4raic@4ax.com...
> On Sat, 06 Jun 2009 13:18:11 -0400, Lem <lemp40@unknownhost> wrote in
> <#F#tErs5JHA.6***@TK2MSFTNGP02.phx.gbl>:
>
>>Peter Boulding wrote:
>>> The setup: a WinXPSP3 PC connected to the internet via a network cable
>>> linking its Realtek RTL8139 Family PCI network adaptor to a four-port
>>> Netgear DG834G (v3--UK) wireless firewall ADSL router. Wireless
>>> capability
>>> is not currently in use and is disabled; no other PC is currently
>>> connected
>>> to the router.
>>>
>>>
>>> The user (me): a novice as regards XP, networking, and ADSL.
>>>
>>>
>>> The problem:
>>>
>>> Sometimes, when I boot up the PC, only one network connection is
>>> created--namely "Local Area Connection" (type 'LAN or High Speed
>>> Internet';
>>> Device name 'Realtek RTL8139 Family PCI Fast Ethernet NIC'). When this
>>> happens, all is well.
>>>
>>> But sometimes, when I boot up the PC, a second network connection is
>>> also
>>> created--namely "Internet Connection" (type: 'internet gateway'; Device
>>> name
>>> 'internet connection'). When this happens, the network card talks
>>> incessantly to the router at a rate of approx. 39kbits/sec down, and
>>> 45kbits/sec up (measurements from Networx.exe, a freeware LAN monitor).
>>>
>>> In either case I can access internet services, but in the latter case
>>> the
>>> incessant chatter just never stops; heaven knows what the network card
>>> and
>>> router are trying to tell each other. Every time this data flow appears
>>> on
>>> the Networx graph I get the horrids in case some malware has taken over
>>> my
>>> PC and is sending out a pile of spam or suchlike, although a check on
>>> the
>>> internet connection's status display shows that the packets are only
>>> passing
>>> between the two devices until I make use of an internet service such as
>>> the
>>> web or check mail or suchlike.
>>>
>>> I have repeatedly tried running the 'set up a home or small office
>>> network'
>>> wizard but it appears to make no difference, regardless of which option
>>> I
>>> choose.
>>>
>>> XP's choice as regards whether or not to set up that second connection
>>> appears to be quite random as far as I'm concerned... I'd be most
>>> grateful
>>> for advice on how to solve this odd and slightly unnerving problem.
>>> Please
>>> bear in mind that, although PC literate, I'm something of a novice in
>>> this
>>> area.
>>>
>>
>>The "Internet Gateway" icon is a means of accessing and configuring your
>>router without having to use a browser to access its built-in web
>>configuration pages.
>
> Hmm... It does let me display some very limited info from the router,
> including the passage of packets between the router and my ISP's gateway,
> and to "disable" it--which causes the router to disconnect my ADSL link,
> but
> mostly it tells me I don't have permission; I have to use my browser to
> see
> and change most router settings.
>
>>If you don't want it, go into your router's
>>configuration pages and disable UPnP (Universal Plug and Play).
>
> OK ... have done, and this indeed has stopped the incessant data flow
> between network card and router.
>
>>Alternately, you can disable UPnP:
>>
>>- Manually disable the UPnP device host service by typing "services.msc"
>>(without quotes) in Start > Run and set Startup Type to "Disabled."
>>
>>- Use Steve Gibson's utility to do it: http://www.grc.com/unpnp/unpnp.htm
>
> Haven't tried disabling UPnP on the PC, having no idea what else that
> might
> affect (or why I might want it in the future).
>
>>Probably more than you want to know:
>>Settings for minimizing periodic WAN traffic
>>http://support.microsoft.com/kb/819108
>
> Indeed: that KB article is talking about stuff I know damn all about.
> Luckily it also seems to be pretty irrelevant to my setup, with XP Home;
> no
> domain controller involved; no dialup or ISDN; and NetBIOS disabled.
>
>
> Anyway: disabling the router's UPnP service has done the trick--for which
> my
> grateful thanks--but I still wonder what the Hell could cause UPnP to need
> to send non-stop traffic to the network card at a rate of 39kbits/sec and
> cause the card to reply with an equally continuous 45kbits/sec.
>
> --
> Regards,   Peter Boulding
> pjbnews1@UNSPAMpboulding.co.uk (to e-mail, remove "UNSPAM")
> Fractal Music and Images: http://www.pboulding.co.uk/ and
> http://www.soundclick.com/bands/default.cfm?bandID=794240&content=music
Author
7 Jun 2009 3:34 PM
Peter Boulding
On Sat, 6 Jun 2009 21:47:52 -0400, "Jack [MVP-Networking]"
<j***@discussiongroup.com> wrote in <em1eXIx5JHA.1***@TK2MSFTNGP06.phx.gbl>:

>>I still wonder what the Hell could cause UPnP to need
>> to send non-stop traffic to the network card at a rate of 39kbits/sec and
>> cause the card to reply with an equally continuous 45kbits/sec.

>Quote: "If you haven't yet tackled the constant UPnP chatter on your
>network, read on to discover what UPnP traffic is".
>Continue here,
>http://windowsitpro.com/article/articleid/26008/the-perils-of-upnp.html

Without being a subscriber I only get to read the first two paragraphs, but
that includes: "Every time the UPnP specter raises its ugly head, the
traffic pattern is always consistent: The firewall logs four UPnP packets
every 25 seconds from each system, 24 hours a day."

For that to explain a continuous data flow of around 5 KB/sec from a single
network card to the router each UPnP packet would have to be around 30KB in
size... Is that realistic?

--
Regards,   Peter Boulding
pjbnews1@UNSPAMpboulding.co.uk (to e-mail, remove "UNSPAM")
Fractal Music and Images: http://www.pboulding.co.uk/ and
http://www.soundclick.com/bands/default.cfm?bandID=794240&content=music
Author
7 Jun 2009 8:46 PM
Jack [MVP-Networking]
Hi
If you have on the computer an application that is UPnP aware/enable the
chatter would be more than the regular.
Best (good security wise too) is to disable UPnP on the Router and configure
(if needed) port forwarding manually.
Jack (MS, MVP-Networking)

Show quoteHide quote
"Peter Boulding" <pjbnews1@UNSPAMpboulding.co.uk> wrote in message
news:j3nn251v7nmac23a9nop8docof7dihmko1@4ax.com...
> On Sat, 6 Jun 2009 21:47:52 -0400, "Jack [MVP-Networking]"
> <j***@discussiongroup.com> wrote in
> <em1eXIx5JHA.1***@TK2MSFTNGP06.phx.gbl>:
>
>>>I still wonder what the Hell could cause UPnP to need
>>> to send non-stop traffic to the network card at a rate of 39kbits/sec
>>> and
>>> cause the card to reply with an equally continuous 45kbits/sec.
>
>>Quote: "If you haven't yet tackled the constant UPnP chatter on your
>>network, read on to discover what UPnP traffic is".
>>Continue here,
>>http://windowsitpro.com/article/articleid/26008/the-perils-of-upnp.html
>
> Without being a subscriber I only get to read the first two paragraphs,
> but
> that includes: "Every time the UPnP specter raises its ugly head, the
> traffic pattern is always consistent: The firewall logs four UPnP packets
> every 25 seconds from each system, 24 hours a day."
>
> For that to explain a continuous data flow of around 5 KB/sec from a
> single
> network card to the router each UPnP packet would have to be around 30KB
> in
> size... Is that realistic?
>
> --
> Regards,   Peter Boulding
> pjbnews1@UNSPAMpboulding.co.uk (to e-mail, remove "UNSPAM")
> Fractal Music and Images: http://www.pboulding.co.uk/ and
> http://www.soundclick.com/bands/default.cfm?bandID=794240&content=music
Author
8 Jun 2009 1:39 AM
Peter Boulding
On Sun, 7 Jun 2009 16:46:52 -0400, "Jack [MVP-Networking]"
<j***@discussiongroup.com> wrote in <#wXy0E75JHA.1***@TK2MSFTNGP05.phx.gbl>:

>If you have on the computer an application that is UPnP aware/enable the
>chatter would be more than the regular.

I've no idea what that might be.

>Best (good security wise too) is to disable UPnP on the Router

Done. (Mind you, web-based "probe my ports" services tend to act respectful
of this PC's refusal to respond, whether or not the router's UPnP service is
disabled.)

>and configure (if needed) port forwarding manually.

I expect I'll be back to ask how to do that one of these days.   :)


--
Thanks and regards,   Peter Boulding
pjbnews1@UNSPAMpboulding.co.uk (to e-mail, remove "UNSPAM")
Fractal Music and Images: http://www.pboulding.co.uk/ and
http://www.soundclick.com/bands/default.cfm?bandID=794240&content=music