Click to See Complete Forum and Search --> : Any netstat experts here?


Konan
09-12-2009, 04:47 PM
Or, just anyone with a familiarity.

I recently installed Hughesnet for my broadband (not my first choice, but the only alternative to 24k dialup). So far it works just fine. I am limited to 200 meg a day, which is far more than I ever use so that is no problem. Except...

A few days ago, my internet session slowed to a crawl. Looking at my stats, I realised that I had been Fapped. That is, my access was limited for 24 hours for going over my download limit. I didn't know why.

The next day, it happened again, but this time I noticed a solid receive signal on my router. I was not surfing or downloaded anything at the time. I don't think I even had Firefox started.

The next day, again, but this time I immediately killed the link at the router and and restarted. Whatever the connection was didn't start up again.

I assumed that something was calling home and trying to download an update, even though I have autoupdates turned off on everything I have loaded that has that option. Since it will download at least 220 meg before being blocked, I can't imagine what update would be so large.

I wrote a script to search the hard drive from top to bottom to give me any file or directory with a create or modify date around the times that I noticed the downloads. I have found nothing except for small stuff like history files for Firefox, etc. However, so far it has only happened when I am using the computer, never during the bulk of the day when it is inactive. That makes me thing that something that I am doing is triggering the activity.

The next time it happens, I want to run a utility to see where the download is coming from. Netstat appears to be an option. Or, does anybody have another suggestion?

Thanks
Konan

je_fro
09-12-2009, 10:24 PM
You could shut everything down and start wireshark... see every packet that comes or goes...

DarbyWeaver
09-13-2009, 01:44 AM
netstat -an and you can pipe its output to a text file.

I second the wireshark idea - I'm a sniffer certified master, so I'm biased to that approach but netstat is first and easier. And it can show you the process and from there you can find the binary that may be responsible for your issue.