2

I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about 200–250MB. This seems to me very suspicious.

I have noticed that a data is constantly sent to 255.255.255.255. Is that OK?

In general, how can identify all processes that are sending some kind of data over Internet on Windows 7?

Gilles 'SO- stop being evil'
  • 51,955
  • 14
  • 122
  • 182
jilt3d
  • 141
  • 1
  • 2
  • 5
  • Could it be a key logger with video monitoring ?? Have you tried to scan your Pc for malicious apps ? – HSN Dec 25 '12 at 12:17
  • I have tried with "Spybot" (available as a portable app) and scanned my machine with "Avast" anti-virus. There were no any high level threats - only a few tracing cookies. Can you recommend any valuable software tool scanning for such malicious applications? – jilt3d Dec 25 '12 at 12:33
  • This question has already been discussed at http://security.stackexchange.com/questions/20027/how-to-check-if-someone-is-in-my-computer/20043#20043 – Ali Ahmad Dec 25 '12 at 12:56
  • @AliAhmad: I've used netstat -oa to list all active connection and the PIDs of the services related but I am still not unable to identify the meaning of sending data to 255.255.255.255. In the result list of the command, there is no any entry for the address 255.255.255.255. – jilt3d Dec 25 '12 at 13:22
  • 1
    @jilt3d: 255.255.255.255 is a broadcast address and when something is send on this address it is received by all the devices on a same network. Secondly routers are configured to block broadcast traffic. – Ali Ahmad Dec 25 '12 at 17:38
  • I think troubleshooting your network configurations may resolve the problem. – Ali Ahmad Dec 25 '12 at 18:07
  • @AliAhmad: actually that was the initial issue. I was constantly disconnected from my Internet connection and I was troubleshooting each time, but nothing helps. My Internet provider told me that they registered a large amount of upload traffic (around 2GB for a day) which causes some kind of bandwidth throttling and this may be the reason behind the constantly dropping connection. – jilt3d Dec 26 '12 at 11:36
  • @jilt3d:It will be helpful if you can generate network traffic networks logs with wireshark or tcpdump. Analyzing traffic logs may reveal uplink traffic you are interested in. – Ali Ahmad Dec 26 '12 at 11:47

3 Answers3

3

You could try to use Sysinternal's Portmon to see which process(es) broadcasts on 255.255.255.255. Don't be too alarmed before you see what kind of things are broadcasted.

To see a more precise view of the packets sent/received, use : wireshark.

Olivier Dulac
  • 405
  • 1
  • 4
  • 11
  • I am not able to use "Portmon" under Windows 7 - I followed the instructions to run it on non-network disk with administrator privileges but capture can not be started. – jilt3d Dec 26 '12 at 12:31
  • "wireshark" provides a lot of information - more than I need I guess, and it seems it will be harder for me to extract the valuable one. Think, it will be easier and more reliable solution to re-install my OS to get rid off any potential harmful applications installed on my machine. I will play a bit more with these tools, and if there is any progress I will update the thread. – jilt3d Dec 26 '12 at 13:00
  • It is probably wiser indeed. However, you can "filter" things with Wireshark, but you should probably ask your local nerd to have a look at it, or spend quite a lot of time in search engines or reading its documentation... I could help with specific questions. To get you started with wireshark: on top, there is a "filter" you can use to filter down the packets: enter in it "ip.dst==255.255.255.255" and you'll see packets sent to this destination (note however that there are more broadcast adresses, the others depending on your local network configuration) (and many legit broadcasts) – Olivier Dulac Dec 26 '12 at 13:22
  • Well, I did a factory restore to the system from a special partition, just to be on the safe side and get rid of any potential malwares, but now I am getting a strange error at the Windows 7 startup. Here you may want to check the details: http://security.stackexchange.com/questions/26115/multiple-running-instances-of-rundll32-exe – jilt3d Dec 28 '12 at 15:10
1

I recommend the built-in Windows 7 functionality.

Bring up your task manager by pressing ctrl + shift + esc then click the Performance tab. From there you will see a Resource Monitor button towards the bottom. Click that and then click the Network tab on the new window that opens.

k1DBLITZ
  • 3,973
  • 16
  • 20
0

I think you need to debug some of your installed applications generating broadcast traffic.You can compute your broadcast address by replacing all the host bits with 1s i.e If your network is 192.168.1.0/24, then your network address will be 192.168.1.0 and your broadcast address will be 192.168.1.255. 255.255.255.255 is physical layer broadcast address and 192.168.1.0/24 is a network layer broadcast address. You need to identify application using your network layer broadcast address not physical broadcast address.

Ali Ahmad
  • 4,844
  • 8
  • 37
  • 61