What's using my bandwidth?

I think this is a FAQ, but I can't remember the A if there is one .. (-:

I use bitMeter2 with the audio feedback turned on; I know this would
drive most people nuts, but each to his own. It alerts me to unusual
activity.

Of late, I've noticed something is using my bandwidth to a TINY but
fairly consistent extent: I have BM2 set to alert every 100 kB, and it's
doing so about every 28-30 seconds - as you can see, very low level, but
higher than before. Looking at the graph in BM2, it's about 1/3 or 1/4
outgoing, 2/3 or 3/4 incoming. http://255soft.uk/temp/Clipboard01.gif is
a sample grab (red is incoming, green outgoing [shows as yellow where
coincident with incoming]) - as you can see, we're not talking huge data
volumes here!

I've turned off everything _I_ can think of that might be causing it, to
no effect. Eventually, random sniping in Task Manager, I found one of
the svchost instances (there are currently 13 of them, all belonging to
"User"s LOCAL SERVICE, NETWORK SERVICE, or SYSTEM - none to me) is
responsible, but I'm none the wiser of course. And killing it, it
reappears after a few tens of seconds. But obviously I don't want to go
just killing random processes in TM.

Being less paranoid than some here, I'm not too _worried_ - at such a
low rate, it's not exactly looting my pron collection, and it's more
incoming than outgoing anyway, which makes me _doubt_ it's some sort of
security probing. I'm just _curious_ as to what it is - and I feel that
surely it must be a common wonderment, and I'd have thought there must
be some way simpler than using Wireshark or Process Explorer to answer
the simple question in the subject.
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

Norman Tebbitt has the irritating quality of being much nicer in person than
he is in print. - Clive Anderson, RT 1996/10/12-18