LAN Traffic

I am running TCPView (Sysinternals) to monitor home LAN and Internet
traffic.
I have several Buffalo NAS deployed on my LAN. Mfr is Buffalo.
I have several PCs.

Last night I observed over 200 M Bytes of "Rcvd Bytes" and 150 M Bytes
of "Sent Bytes".

Each Buffalo NAS was doing this high traffic.

I only have one Buffalo NAS assigned for backup.

I have another NAS attached but this is a different brand and there were
zero bytes going either direction.

"Local Address" was the PC running TCPView.
All TCP "Protocol".

What is all this traffic ?

In news wrote:

"Local Address" was the PC running TCPView.
All TCP "Protocol".

What is all this traffic ?

My version of TCPView (3.05) shows the name of the program on the PC
that's on the local end of the traffic.

You might find more information in one of the panels of "Resource
Monitor."

--
St. Paul, MN

AIOEAccess wrote:
I am running TCPView (Sysinternals) to monitor home LAN and Internet
traffic.
I have several Buffalo NAS deployed on my LAN. Mfr is Buffalo.
I have several PCs.

Last night I observed over 200 M Bytes of "Rcvd Bytes" and 150 M Bytes
of "Sent Bytes".

Each Buffalo NAS was doing this high traffic.

I only have one Buffalo NAS assigned for backup.

I have another NAS attached but this is a different brand and there were
zero bytes going either direction.

"Local Address" was the PC running TCPView.
All TCP "Protocol".

What is all this traffic ?

1) I'd be using my copy of Wireshark, in addition to TCPView.
In the older versions of Wireshark, there was a "conversation view"
capability, that worked at a higher level than raw bytes, so
you could kinda get an impression of what was going on.

2) What features are enabled on the Buffalo ?
SNMP ? UPNP ? DLNA ? PrintServer ? flavor-of-the-week ?

3) What is the model number of the Buffalo ?
Have you Googled the model number to see similar
experiences ? Is there a Buffalo forum, where
"model X" users hang out ?

4) Does the Buffalo box have a "console port" ?
On some products, this is a TTL level RS232 header,
for which you need a cell-phone type TTL RS232 to USB
adapter for interconnect. Then, you need your passwords
handy, in case the console port has a login. Or other
measures might be needed, if the console port isn't
enabled by default.

I have a network box here, that sends a status packet every
couple of seconds. But I turned that on, just so I could
see it was alive :-)

The fact the traffic level is symmetric, suggests a protocol
used to "sniff what is on the network". In a similar way to
how Windows PCs have a "network browser" used to "elect a master".
On a quiet network, that might be the only thing your copy
of Wireshark shows on display.

HTH,
Paul

TCPView shows only the names of the NAS and the name of the PC.

There is nothing I have done to the NAS other than standard plug in and
use. Only the CAT5 cable is plugged into them.

I tried wireshark and got lost in its complexity.

TCPView seems like an excellent app for me.

I cannot understand why there is so much data being moved around.

Is there an ethernet remote control switch that I can use to turn the
NAS on and off from a PC on the LAN? That would solve the problem.

aioeAccess wrote:
TCPView shows only the names of the NAS and the name of the PC.

There is nothing I have done to the NAS other than standard plug in and
use. Only the CAT5 cable is plugged into them.

I tried wireshark and got lost in its complexity.

TCPView seems like an excellent app for me.

I cannot understand why there is so much data being moved around.

Is there an ethernet remote control switch that I can use to turn the
NAS on and off from a PC on the LAN? That would solve the problem.


Microsoft has their own.

"Microsoft Network Monitor 3.4 (2010)"

https://www.microsoft.com/en-ca/down...s.aspx?id=4865

This is what it looks like. It looks like it sorts traffic
by "from-to" pairs. In this example, Firefox is talking to a web
server on the Internet.

http://d2.alternativeto.net/dist/s/7...&upscale=false

Paul