On Sat, 05 Jan 2019 06:10:51 -0500, Paul
wrote:

J. P. Gilliver (John) wrote:
I think this is a FAQ, but I can't remember the A if there is one .. (-:

I use bitMeter2 with the audio feedback turned on; I know this would
drive most people nuts, but each to his own. It alerts me to unusual
activity.

Of late, I've noticed something is using my bandwidth to a TINY but
fairly consistent extent: I have BM2 set to alert every 100 kB, and it's
doing so about every 28-30 seconds - as you can see, very low level, but
higher than before. Looking at the graph in BM2, it's about 1/3 or 1/4
outgoing, 2/3 or 3/4 incoming. http://255soft.uk/temp/Clipboard01.gif is
a sample grab (red is incoming, green outgoing [shows as yellow where
coincident with incoming]) - as you can see, we're not talking huge data
volumes here!

I've turned off everything _I_ can think of that might be causing it, to
no effect. Eventually, random sniping in Task Manager, I found one of
the svchost instances (there are currently 13 of them, all belonging to
"User"s LOCAL SERVICE, NETWORK SERVICE, or SYSTEM - none to me) is
responsible, but I'm none the wiser of course. And killing it, it
reappears after a few tens of seconds. But obviously I don't want to go
just killing random processes in TM.

Being less paranoid than some here, I'm not too _worried_ - at such a
low rate, it's not exactly looting my pron collection, and it's more
incoming than outgoing anyway, which makes me _doubt_ it's some sort of
security probing. I'm just _curious_ as to what it is - and I feel that
surely it must be a common wonderment, and I'd have thought there must
be some way simpler than using Wireshark or Process Explorer to answer
the simple question in the subject.

You could use TCPView and sort by transmitted or received packet count.
To make the culprit float to the top.

https://docs.microsoft.com/en-us/sys...nloads/tcpview

Run Process Explorer as Administrator. This no longer runs
in WinXP, but should work on later OSes. In particular, you
can "sort by PID", highlight a service host and do Properties,
and see what's running in the thread view perhaps.

I have a Process Explorer running on my XP, it's version 11.13,
probably ancient. I don't seem to be able to 'sort on PID' with it. I
still have the zip file it came in if it's of any use to anyone.

https://docs.microsoft.com/en-us/sys...ocess-explorer

This kinda crap happens in Windows 10, and may be tied to
Delivery Optimization ("dosvc"). While Windows 10 initially
might have used BITS for every download purpose, the "dosvc"
is like a Torrent, and allows one Windows 10 machine to
share files with another Windows 10 machine. I don't think
these have been ported to Windows 7.

I have a test setup for Windows 10, where I use GPEDIT to
disable "dosvc" and that's supposed to cause all downloads
to switch to BITS. The advantage of doing that, might be
that BITS has more manageable router behavior (can engineer
hog-stopping on BITS via limiting the max connections).
However, after the test setup was switched to BITS, the
OS "refuses" to do updates :-)

Anyway, enjoy your new hobby. I've always enjoyed the IP
addresses that don't reverse-translate and so on. With
that sort of thing present, who would possibly end up with
a paranoia ? The machine should always have unchartable
activities going on, just to "keep you awake".

Paul