Computer sending/receiving large amounts of data while idle

[Jed Sheckler]

I'm managing a computer that acts as a simple file server for our office.
It's brand new, running windows xp professional. I noticed recently that it
is sending and receiving data at a very high rate, even when idle.
(Receiving at ~1mb every 2-3 minutes, sending at ~1/2 that.) I have shut
down all connections from other computers to it, and shut down as many
processes as possible, but can't isolate where this data is coming from or
going to. I would suspect ad-ware, but the machine runs both Spysweeper and
Ad-aware regularly, and they report nothing more than cookies. If anyone
could offer suggestions as to how I can track the source of this data, I'd
appreciate it.

Jed

 

[Lance]

You don't say anything about security or network arrangement on this
server. It's hard to tell what's going on without this information or
without tracking down the exact process that's creating the traffic.

This could be normal background network traffic or it could be hackers
using your server for who-knows-what.

If it were my machine, I'd immediately disconnect it from the network,
perform a virus-scan and then install a firewall to start
troubleshooting. A third-party firewall like ZoneAlarm or Kerio will be
able to give enough information on ports, processes, etc to track down
what's going on.

Lance
*****

Jed Sheckler said the following on 9/3/2004 6:50 AM:

 

[Jed Sheckler]

Thanks for the reply Lance. I just installed a program called BWMeter,
which lets me monitor network traffic. This program shows me that the
traffic is coming from the LAN, not from the Internet, and allows me to
monitor where the packets are coming from and going to in real-time. It
appears that this machine is sending and receiving packets to and from the
other machines on the network at a very high rate of speed. If this is the
case, it appears to be innocuous, but any ideas WHY it's doing this?
Thanks.

Jed