Is this...normal?

[Burke]

I just opened my network connection to check on something, and this is what I saw:

http://www.burkehamblin.net/images/speedguide/lan_weird.jpg

Does this look "normal"? It seems rather strange...

[MikeyMan]

You've been doing a lot of uploading.... your PMTU is off, your upload packets are too small, windows is about as accurate as a blind 1 armed archer.

Your pick. :)

[cyberskye]

If you aren't running any p2p or ftp you may have a problem. I would reboot and then run (netstat -an) before starting any other apps.


Skye

Edit: If you see any "established" or "listening" connections and you aren't running a server you should post in the security forum.

[Burke]

Originally posted by cyberskye
If you aren't running any p2p or ftp you may have a problem. I would reboot and then run (netstat -an) before starting any other apps.


Skye

Edit: If you see any "established" or "listening" connections and you aren't running a server you should post in the security forum.

I'm not running P2P or FTP, so when I get home I'll check out your suggestion. Could it be a symptom of someone installing a back door somehow? That's scary.

[cyberskye]

That's what I was thinking. You may be participating in DDoS or simply upload data from your hard drive. Those options to the netstat command will give you the status and prtocol of all connections and the ip address that you are connected to. Record the ip address(es).

Then check out http://antitrojan.net and get yourself a copy - it's free for a certain number of uses, I believe.

Again, if you find anything suspicious, post in the security forum.

Skye

[Burke]

Originally posted by cyberskye
That's what I was thinking. You may be participating in DDoS or simply upload data from your hard drive. Those options to the netstat command will give you the status and prtocol of all connections and the ip address that you are connected to. Record the ip address(es).

Then check out http://antitrojan.net and get yourself a copy - it's free for a certain number of uses, I believe.

Again, if you find anything suspicious, post in the security forum.

Skye

Will do. Thanks for the advice.

[Burke]

Originally posted by cyberskye
That's what I was thinking. You may be participating in DDoS or simply upload data from your hard drive. Those options to the netstat command will give you the status and prtocol of all connections and the ip address that you are connected to. Record the ip address(es).

Then check out http://antitrojan.net and get yourself a copy - it's free for a certain number of uses, I believe.

Again, if you find anything suspicious, post in the security forum.

Skye

I tried running netstat and a DOS-type box came up but it closed before I could look at any of the info!

I used that Trojan Scanner, but it found nothing; I scanned with Norton 2002, latest definitions and max detection settings, but no viruses. I used Sygate and Shields Up to probe my ports, and it reports stealth. I unchecked everything from ZoneAlarm's approved apps list, but it's still happening.

Man!

[greEd]

open a dos window first ... then type netstat -an.

[Burke]

After following all the suggestions and doing some of my own investigating, I found the culprit.

It might sound strange, and I blame myself for breaking one of my own rules, but NEVER download a "Recommended Driver Update" from the Windows Update site. I "reverse engineered" a bit and discovered that the problem came about after I installed Microsoft's recommended driver to my Intel Pro 10/100 LAN. I rolled back the driver, rebooted and voila! problem solved. The Sent packets are now back to 'normal'. Beats me why the newer driver would cause it. I've had the same kind of headaches from installing DirectX releases via Windows Update, but had no trouble when I downloaded it separately.

I guess I should just follow my own advice more often in the future...

[mnosteele52]

That's true Roadbuster, you should ALWAYS use the drivers from the manufacturer - NOT Microsoft. Look at Intel's site for a driver update.:)

[Burke]

Originally posted by mnosteele52
That's true Roadbuster, you should ALWAYS use the drivers from the manufacturer - NOT Microsoft. Look at Intel's site for a driver update.:)

Luckily, sudden loss of sanity and common computing sense can easily be remedied by Drive Image!