0

I have been experiencing this issue for some time now (maybe 1-2 months), and didn't know if it was something from my ISP or my computer, but I have sudden burst of network activity happening in the background, and that severely impacts my online gaming.

What happens is that suddenly, something is downloading a big amount of data, clogging the connection for a few seconds, then everything comes back to normal. And then it happens within the next 10 minutes or so. It is not very regular, and not always with the same intensity.

I started thinking that it might be a Trojan or Malware, but neither Norton nor McAfee (which ere both active and up to date on my comp before this started to happen) have found anything suspect on my computer. Not a proof, but I can't be certain.

My question is: Do you know of a tool that would be able to track network activity on my computer and would let me know from which process it originates? That would help me figure out if it comes from a legit programme or not.

Any other idea to get rid of this nuisance is appreciated.

Thanks

10
  • Use wireshark to monitor what's going on. Leave it running for while. Once you get a good sample of the traffic, upload a snapshot picture. That will help provide a lot of info.
    – Nate
    Aug 12, 2014 at 22:05
  • Alright. Downloaded, installed and run a live capture... Loads of stuff on the screen, but I am way beyond my skillset here and have no idea how to interpret that information flow.
    – user138460
    Aug 12, 2014 at 23:14
  • When things go crazy and you notice your activity burst, take a snapshot there and upload it.
    – Nate
    Aug 12, 2014 at 23:15
  • Mmm I will try, but Stackoverflow tells me that I need at least 10 reputation before I can post pictures. When I can capture this, I will put it on my GDrive and post the link
    – user138460
    Aug 12, 2014 at 23:16
  • Can you see onedrive.live.com/…
    – user138460
    Aug 12, 2014 at 23:23

2 Answers 2

0

I use Comodo Firewall. It's free and you can monitor the "outbound" connections. You can also set it up in "training" mode which will ask you for all the connections being generated from your computer and let you choose a permanent rule (or temporary) for them.

2
  • Thanks for the advice. I already have Norton's firewall, but I can't find a way to track whose programme activity it is. I'll try that one
    – user138460
    Aug 12, 2014 at 21:49
  • It's not the same. Typical firewalls only warn you about "incoming" connections. Comodo Firewall also warns/manage your "outgoing" connections.
    – Marcelo
    Aug 12, 2014 at 22:05
0

Based on the wireshark picture, it looks like your computer is being used in a DDOS attack. In particular, a teardrop attack (see link), where massively oversized TCP packets are continuously being sent. You'll notice that your computer keeps sending TCP segments of length 1484. Each of these segments add up to make one large packet.

Why they are targetting Google exactly, I can't say. I feel that Google probably has enough infrastructure to handle multiple DDOS attacks at once and no one would be truly affected. But that's just a hunch.

Start by using Comodo Firewall, as mentioned, to block outgoing traffic to 64.233.166.139. Try and set it up to monitor any strange outgoing traffic.

Also, use your antivirus to scan your system. You mentioned that you use Norton and MCaffee. Firstly, you should only have one antivirus running at a time. If you have both installed on your system, fine, but one should be disabled and only used for an occasional on demand scan. Secondly, I'm not a personal fan of either of those antivirus packages (my opinion only!). I'd recommend AVG.

Research any info on how to remove this from your system, but if all else fails, wipe your computer and start from scratch.

Here's a helpful artical on DDOS Zombies (Which you might just be). [link]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .